CWE-798
Allowed-with-ReviewUse of Hard-coded Credentials
Abstraction: Base · Status: Draft
The product contains hard-coded credentials, such as a password or cryptographic key.
2176 vulnerabilities reference this CWE, most recent first.
GHSA-PRP3-P73X-MQJC
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
{
"affected": [],
"aliases": [
"CVE-2021-28912"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-09T18:15:00Z",
"severity": "HIGH"
},
"details": "BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as \u0027eibPort string\u0027. This is usable and the final part of an attack chain to gain SSH root access.",
"id": "GHSA-prp3-p73x-mqjc",
"modified": "2022-05-24T19:13:58Z",
"published": "2022-05-24T19:13:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28912"
},
{
"type": "WEB",
"url": "https://psytester.github.io/CVE-2021-28912"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PRQR-5WJ2-GC33
Vulnerability from github – Published: 2021-12-27 00:01 – Updated: 2022-01-05 00:01NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password.
{
"affected": [],
"aliases": [
"CVE-2021-45522"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-26T01:15:00Z",
"severity": "HIGH"
},
"details": "NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password.",
"id": "GHSA-prqr-5wj2-gc33",
"modified": "2022-01-05T00:01:40Z",
"published": "2021-12-27T00:01:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45522"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000064155/Security-Advisory-for-Hardcoded-Password-on-XR1000-PSV-2021-0030"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PRV5-C2PX-J9Q3
Vulnerability from github – Published: 2025-12-12 15:30 – Updated: 2025-12-12 21:36In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.
This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.
Users are recommended to upgrade to version 2.1.7, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.streampark:streampark"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54947"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-12T19:22:52Z",
"nvd_published_at": "2025-12-12T15:15:53Z",
"severity": "HIGH"
},
"details": "In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access.\n\nThis issue affects Apache StreamPark: from 2.0.0 before 2.1.7.\n\nUsers are recommended to upgrade to version 2.1.7, which fixes the issue.",
"id": "GHSA-prv5-c2px-j9q3",
"modified": "2025-12-12T21:36:13Z",
"published": "2025-12-12T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54947"
},
{
"type": "WEB",
"url": "https://github.com/apache/streampark/commit/39034db0c806168afa82e58e4f376e1e3c3b73e4"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/streampark"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/kdntmzyzrco75x9q6mc6s8lty1fxmog1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/12/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache StreamPark has a hard-coded encryption key"
}
GHSA-PV3V-VR5F-9CH6
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 21:31Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi – Cuotas que se adaptan a ti: from n/a through <= 2.0.4.
{
"affected": [],
"aliases": [
"CVE-2026-27073"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:54Z",
"severity": "HIGH"
},
"details": "Use of Hard-coded Credentials vulnerability in Addi Addi \u0026#8211; Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi \u0026#8211; Cuotas que se adaptan a ti: from n/a through \u003c= 2.0.4.",
"id": "GHSA-pv3v-vr5f-9ch6",
"modified": "2026-03-26T21:31:25Z",
"published": "2026-03-25T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27073"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/buy-now-pay-later-addi/vulnerability/wordpress-addi-cuotas-que-se-adaptan-a-ti-plugin-2-0-4-broken-authentication-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PV7P-2X54-XVC3
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default blank password for the guest account.
{
"affected": [],
"aliases": [
"CVE-2020-29062"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-24T21:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default blank password for the guest account.",
"id": "GHSA-pv7p-2x54-xvc3",
"modified": "2022-05-24T17:34:55Z",
"published": "2022-05-24T17:34:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PVM2-WCHQ-HWV5
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner.
{
"affected": [],
"aliases": [
"CVE-2020-15833"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-01T02:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner.",
"id": "GHSA-pvm2-wchq-hwv5",
"modified": "2022-05-24T17:40:41Z",
"published": "2022-05-24T17:40:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15833"
},
{
"type": "WEB",
"url": "https://mofinetwork.com/index.php?main_page=page\u0026id=14"
},
{
"type": "WEB",
"url": "https://www.criticalstart.com/critical-vulnerabilities-discovered-in-mofi-routers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PVPX-GXVP-44WQ
Vulnerability from github – Published: 2023-02-23 06:30 – Updated: 2023-03-03 03:30ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)
{
"affected": [],
"aliases": [
"CVE-2023-26462"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-23T06:15:00Z",
"severity": "CRITICAL"
},
"details": "ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)",
"id": "GHSA-pvpx-gxvp-44wq",
"modified": "2023-03-03T03:30:24Z",
"published": "2023-02-23T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26462"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/238544"
},
{
"type": "WEB",
"url": "https://thingsboard.io/docs/reference/releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PW6P-WR56-Q7JH
Vulnerability from github – Published: 2023-09-07 15:30 – Updated: 2024-04-04 07:32The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.
{
"affected": [],
"aliases": [
"CVE-2023-39420"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-07T13:15:08Z",
"severity": "HIGH"
},
"details": "The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an \"admin\" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.",
"id": "GHSA-pw6p-wr56-q7jh",
"modified": "2024-04-04T07:32:48Z",
"published": "2023-09-07T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39420"
},
{
"type": "WEB",
"url": "https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PXP7-P7XV-7463
Vulnerability from github – Published: 2022-05-17 02:57 – Updated: 2022-05-17 02:57The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
{
"affected": [],
"aliases": [
"CVE-2016-8491"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-01T17:59:00Z",
"severity": "CRITICAL"
},
"details": "The presence of a hardcoded account named \u0027core\u0027 in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.",
"id": "GHSA-pxp7-p7xv-7463",
"modified": "2022-05-17T02:57:53Z",
"published": "2022-05-17T02:57:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8491"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-16-065"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94186"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q22M-MCVP-RXGV
Vulnerability from github – Published: 2023-12-07 18:30 – Updated: 2023-12-12 21:31NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
{
"affected": [],
"aliases": [
"CVE-2023-40300"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-07T18:15:07Z",
"severity": "CRITICAL"
},
"details": "NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.",
"id": "GHSA-q22m-mcvp-rxgv",
"modified": "2023-12-12T21:31:08Z",
"published": "2023-12-07T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40300"
},
{
"type": "WEB",
"url": "https://www.netscout.com/securityadvisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
- In Windows environments, the Encrypted File System (EFS) may provide some protection.
Mitigation
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
Mitigation
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Mitigation
- For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
- Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
Mitigation
- For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
CAPEC-191: Read Sensitive Constants Within an Executable
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
CAPEC-70: Try Common or Default Usernames and Passwords
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.