Weakness (CWE)
CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
How to prevent it (5 mitigations)
-
Architecture and Design
For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
In Windows environments, the Encrypted File System (EFS) may provide some protection.
-
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
-
Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
-
Architecture and Design
For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
-
Architecture and Design
For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
Source: MITRE CWE-798
346 results · Clear filters · Feed
-
High 8.8
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integratio…
-
High 8.4
Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded cr…
-
High 7.5
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for…
-
High 7.5
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accom…
-
High 7.5
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") …
-
High 7.8
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine…
-
High 7.2
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by inj…
-
High 7.5CVE-2022-37255 Public exploit
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL0755264…
-
High 7.8
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an exter…
-
High 7.5
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in t…
-
High 7.5
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.
-
High 7.8
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local at…
-
High 7.8
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
-
High 7.1
Hardcoded credential is found in the message queue
Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the internal message queue. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN…
-
High 8.0
The affected products store public and private key that are used to sign and protect custom parameter set files from modification.
The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trus…
-
High 7.1
Use of default key for encryption
In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. T…
-
High 7.5
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the …
-
High 8.4
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L…
-
High 7.5
Common Key Vulnerability in Serv-U FTP Server
Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.
-
High 8.3
MegaRAC Default Credentials Vulnerability
MegaRAC Default Credentials Vulnerability
-
High 7.5
MegaRAC Default Credentials Vulnerability
MegaRAC Default Credentials Vulnerability
-
High 8.1
ERP solution Remote Code Execution Vulnerability
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.
-
High 7.8
Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > L…
-
High 8.6
An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc…
-
High 7.8CVE-2022-42176 Public exploit
In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.
-
High 7.5CVE-2022-38420 EPSS 45%
Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. Exploitation of t…
-
High 8.8
Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the comp…
-
High 8.8CVE-2021-43116 Public exploit
Use of Hard-coded Credentials in Nacos
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
-
High 8.8CVE-2022-29778 Public exploit
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the para…
-
High 8.8
KUKA KR C4 - Use of Hard-Coded Credentials
An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
-
High 8.8
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud …
-
High 7.5
Apache Doris hardcoded cryptography initialization
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
-
High 7.3
ASUS WebStorage - Use of Hard-coded Credentials
ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user accoun…
-
High 7.1
Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the …
-
High 7.3CVE-2022-26671 Public exploit
TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt…
-
High 8.4
GE UR family hardcoded credentials
GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.
-
High 8.8
Hard coded credentials in FreeTAKServer
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
-
High 7.2
Use of Hard-coded Cryptographic Key in Netmaker
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if t…
-
High 8.0
BD Viper LT System - Hardcoded Credentials
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI)…
-
High 7.0
BD Pyxis Products - Hardcoded Credentials
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application creden…