CWE-798 Use of Hard-coded Credentials
baseThe product contains hard-coded credentials, such as a password or cryptographic key.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (2279)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-22769US | critical10.0OT kritisch | KEV | ||
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attack… | ||||
| CVE-2025-14611US | critical9.8OT kritisch | KEV | ||
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose… | ||||
| CVE-2025-30406US | critical9.8OT kritisch | KEV | ||
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited… | ||||
| CVE-2024-20439US | critical9.8OT kritisch | KEV | ||
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.… | ||||
| CVE-2024-28987US | critical9.1OT kritisch | KEV | ||
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify da… | ||||
| CVE-2024-3272US | critical9.8OT kritisch | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue… | ||||
| CVE-2023-6448US | critical9.8OT kritisch | KEV | ||
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take… | ||||
| CVE-2022-26138US | critical9.8OT kritisch | KEV | ||
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuse… | ||||
| CVE-2022-28810US | medium6.8OT kritisch | KEV | ||
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script… | ||||
| CVE-2021-44207US | high8.1OT kritisch | KEV | ||
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | ||||
| CVE-2020-8657US | critical9.8OT kritisch | KEV | ||
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all… | ||||
| CVE-2019-6693US | medium6.5OT kritisch | KEV | ||
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive d… | ||||
| CVE-2019-15975US | critical9.8OT kritisch | Exploit | ||
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and e… | ||||
| CVE-2019-15976US | critical9.8OT kritisch | Exploit | ||
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and e… | ||||
| CVE-2005-2611US | high10.0OT kritisch | Exploit | ||
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static p… | ||||
| CVE-2019-1935US | critical9.8OT hoch | Exploit | ||
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote a… | ||||
| CVE-2019-1619US | critical9.8OT hoch | Exploit | ||
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execu… | ||||
| CVE-2023-5222US | critical9.8OT hoch | Exploit | ||
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of t… | ||||
| CVE-2024-3408US | critical9.8OT hoch | Exploit | ||
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded… | ||||
| CVE-2020-13166US | critical9.8OT hoch | Exploit | ||
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config… | ||||
04
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan