Weakness (CWE)
CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
How to prevent it (5 mitigations)
-
Architecture and Design
For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
In Windows environments, the Encrypted File System (EFS) may provide some protection.
-
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
-
Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
-
Architecture and Design
For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
-
Architecture and Design
For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
Source: MITRE CWE-798
386 results · Clear filters · Feed
-
Critical 9.8
Use of Hard-coded Credentials in Kiloview P1/P2 devices
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
-
Critical 9.3
Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter
TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials.
-
Critical 9.8
Improper Access Control in Talya Informatics' Elektraweb
Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.
-
Critical 9.8
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.
-
Critical 9.3
Hard Coded Credential
Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device.
-
Critical 9.8
Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerabilit…
-
Critical 9.8
Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.
-
Critical 9.8
Apache Submarine Commons Utils: default secret
** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used. This issue affects Apache Submarine Commons Utils: from …
-
Critical 9.0
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
-
Critical 9.8
Authentication Bypass and RCE in man-group/dtale
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session…
-
Critical 9.8
TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, whi…
-
Critical 9.8
MinMax CMS - Hidden Functionality
MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and lo…
-
Critical 9.8
CyberPower PowerPanel business Use of Hard-coded Credentials
Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel business application.
-
Critical 9.6
Weak account password in GE HealthCare EchoPAC products
Weak account password in GE HealthCare EchoPAC products
-
Critical 9.8
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented…
-
Critical 9.8
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this …
-
Critical 9.8
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the co…
KEV Apr 11, 2024 -
Critical 9.8
Use of Hard-coded Credentials in Kiloview NDI N series products API middleware
Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .
-
Critical 9.1
Authentication Bypass Because of Hardcoded JWT Secret in your_spotify
your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for ar…
-
Critical 9.8
An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA…
-
Critical 9.8
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3)…
-
Critical 9.8
An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.
-
Critical 9.8CVE-2024-22853 Public exploit
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote …
-
Critical 9.8
Use of Hard-Coded Credentials in Rapid SCADA
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specific port.
-
Critical 9.1
MachineSense FeverWarn Use of Hard-coded Credentials
Multiple MachineSense devices have credentials unable to be changed by the user or administrator.
-
Critical 9.8
Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER
Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.
-
Critical 9.8
TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.
-
Critical 9.8
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
-
Critical 9.8
IBM Merge Healthcare eFilm Workstation Hardcoded Credentials
A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution.
-
Critical 9.1
FOLIO mod-data-export-spring Hard-Coded Credentials
Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.
-
Critical 9.1
EverShop at risk to unauthorized access via weak HMAC secret
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON W…
-
Critical 9.8
Predefined root password
Root user password is hardcoded into the device and cannot be changed in the user interface.
-
Critical 9.8
Multisuns EasyLog web+ - Use of Hard-coded Password
Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
-
Critical 9.8
SENEC: Storage Box V1,V2 and V3 using default credentials
The affected devices use publicly available default credentials with administrative privileges.
-
Critical 9.8
NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
-
Critical 9.8
First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obt…
-
Critical 9.8
Weintek EasyBuilder Pro Use of Hard-coded Credentials
Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash repo…
-
Critical 9.8
Sureness uses hardcoded key
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
-
Critical 9.8
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug s…
-
Critical 10.0
Qognify NiceVision Use of Hard-coded Credentials
Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records.