CWE-798 Use of Hard-coded Credentials
baseThe product contains hard-coded credentials, such as a password or cryptographic key.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (2279)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-22769US | critical10.0OT critical | KEV | ||
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attack… | ||||
| CVE-2025-14611US | critical9.8OT critical | KEV | ||
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose… | ||||
| CVE-2025-30406US | critical9.8OT critical | KEV | ||
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited… | ||||
| CVE-2024-20439US | critical9.8OT critical | KEV | ||
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.… | ||||
| CVE-2024-28987US | critical9.1OT critical | KEV | ||
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify da… | ||||
| CVE-2024-3272US | critical9.8OT critical | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue… | ||||
| CVE-2023-6448US | critical9.8OT critical | KEV | ||
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take… | ||||
| CVE-2022-26138US | critical9.8OT critical | KEV | ||
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuse… | ||||
| CVE-2022-28810US | medium6.8OT critical | KEV | ||
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script… | ||||
| CVE-2021-44207US | high8.1OT critical | KEV | ||
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | ||||
| CVE-2020-8657US | critical9.8OT critical | KEV | ||
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all… | ||||
| CVE-2019-6693US | medium6.5OT critical | KEV | ||
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive d… | ||||
| CVE-2019-15975US | critical9.8OT critical | Exploit | ||
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and e… | ||||
| CVE-2019-15976US | critical9.8OT critical | Exploit | ||
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and e… | ||||
| CVE-2005-2611US | high10.0OT critical | Exploit | ||
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static p… | ||||
| CVE-2019-1935US | critical9.8OT high | Exploit | ||
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote a… | ||||
| CVE-2019-1619US | critical9.8OT high | Exploit | ||
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execu… | ||||
| CVE-2023-5222US | critical9.8OT high | Exploit | ||
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of t… | ||||
| CVE-2024-3408US | critical9.8OT high | Exploit | ||
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded… | ||||
| CVE-2020-13166US | critical9.8OT high | Exploit | ||
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan