Weakness (CWE)
CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
How to prevent it (5 mitigations)
-
Architecture and Design
For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
In Windows environments, the Encrypted File System (EFS) may provide some protection.
-
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
-
Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
-
Architecture and Design
For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
-
Architecture and Design
For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
Source: MITRE CWE-798
1,055 results · Feed
-
Medium 6.1
A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, …
-
Critical 9.8
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is use…
-
High 7.5
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accom…
-
Critical 9.8
The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish…
-
High 7.5
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") …
-
Critical 9.8
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection s…
-
Critical 9.8
Impersonation through User-Controlled Token
Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher which was …
-
High 7.8
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine…
-
Critical 9.8
An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor…
-
High 7.2
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by inj…
-
Critical 10.0
Use of Hard-coded Credentials in nuxtlabs/github-module
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
-
Critical 9.8
Electra Central AC unit – Hardcoded Credentials
Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit.
-
High 7.5CVE-2022-37255 Public exploit
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL0755264…
-
High 7.8
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an exter…
-
Critical 9.8
Authentication bypass in UniRPC's udadmin service
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to byp…
-
Critical 9.8
VARTA: Multiple devices prone to hard-coded credentials
Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.
-
Critical 9.8
A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote…
-
Medium 6.5
Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 5.4
Gradio contains Use of Hard-coded Credentials
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=…
-
Critical 9.8
Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.
-
Medium 6.3
EnOcean SmartServer Hard-coded credentials
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control…
-
Medium 6.0
PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenti…
-
Medium 4.3
Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access carde…
-
Critical 9.8
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /…
-
Critical 9.8
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the compo…
-
High 7.5
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in t…
-
Critical 9.8
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet servi…
-
High 7.5
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.
-
High 7.8
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local at…
-
Medium 5.5
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password vi…
-
Critical 9.8
EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.
EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.
-
High 7.8
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
-
High 7.1
Hardcoded credential is found in the message queue
Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the internal message queue. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN…
-
High 8.0
The affected products store public and private key that are used to sign and protect custom parameter set files from modification.
The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trus…
-
High 7.1
Use of default key for encryption
In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. T…
-
Critical 9.8
KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator acc…
-
Critical 9.8
Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials
Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.
-
High 7.5
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the …
-
High 8.4
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L…
-
Medium 4.3CVE-2022-4611 Public exploit
Click Studios Passwordstate hard-coded credentials
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…