CWE-798— Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.— MITRE CWE catalog

1,949 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-798page 10 of 39

CVE-2021-27163CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
CVE-2021-27162CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
CVE-2021-27161CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
CVE-2021-27160CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
CVE-2021-27159CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
CVE-2021-27158CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
CVE-2021-27157CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
CVE-2021-27156CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address of the br0 interface.
CVE-2021-27155CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an ISP.
CVE-2021-27154CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
CVE-2021-27153CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
CVE-2021-27152CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
CVE-2021-27151CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
CVE-2021-27150CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
CVE-2021-27149CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
CVE-2021-27148CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
CVE-2021-27147CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
CVE-2021-27146CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
CVE-2021-27145CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
CVE-2021-27144CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
CVE-2021-27143CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
CVE-2021-27141CRITICALCVSS 9.8EG 9.8
2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g key. (The webs binary has details on how XOR is…
CVE-2020-15833CRITICALCVSS 9.8EG 9.8
2021-02-01
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location tha…
CVE-2020-13858CRITICALCVSS 9.8EG 9.8
2021-02-01
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across …
CVE-2020-28998CRITICALCVSS 9.8EG 9.8
2021-01-26
An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that allows a remote attacker to take full control of the device with a high-privileged account. The vulnerability exists becau…
CVE-2020-35929CRITICALCVSS 9.8EG 9.8
2021-01-19
In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker for unauthorized access to remote data.
CVE-2020-10210CRITICALCVSS 9.8EG 9.8
2020-12-29
Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B, an attacker may remotely log in through SSH.
CVE-2020-10207CRITICALCVSS 9.8EG 9.8
2020-12-29
Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows remote attackers to retrieve and modify the device settings.
CVE-2020-11720CRITICALCVSS 9.8EG 9.8
2020-12-23
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by default with the account admin and password 0000. After the installation, users/ad…
CVE-2020-8995CRITICALCVSS 9.8EG 9.8
2020-12-21
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update ser…
CVE-2019-14482CRITICALCVSS 9.8EG 9.8
2020-12-16
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which a…
CVE-2020-35338CRITICALCVSS 9.8EG 9.8
2020-12-14
The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."
CVE-2020-29377CRITICALCVSS 9.8EG 9.8
2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 OLT devices. The string K0LTdi@gnos312$ is compared to the password provided by the the remote attacker. If it matches, access is provided.
CVE-2020-29376CRITICALCVSS 9.8EG 9.8
2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. There is an !j@l#y$z%x6x7q8c9z) password for the admin account to authentica…
CVE-2020-29062CRITICALCVSS 9.8EG 9.8
2020-11-24
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…
CVE-2020-29061CRITICALCVSS 9.8EG 9.8
2020-11-24
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…
CVE-2020-29060CRITICALCVSS 9.8EG 9.8
2020-11-24
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…
CVE-2020-29059CRITICALCVSS 9.8EG 9.8
2020-11-24
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD…
CVE-2020-28329CRITICALCVSS 9.8EG 9.8
2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API…
CVE-2020-28334CRITICALCVSS 9.8EG 9.8
2020-11-24
Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware ima…
CVE-2020-4001CRITICALCVSS 9.8EG 9.8
2020-11-24
The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. SD-WAN Orchestrator ships with default passwords for predefined accounts which may lead to to a Pass-the-Hash attack.
CVE-2020-4854CRITICALCVSS 9.8EG 9.8
2020-11-23
IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of int…
CVE-2020-26097CRITICALCVSS 9.8EG 9.8
2020-11-18
The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. NOTE: This vulnerabi…
CVE-2020-26892CRITICALCVSS 9.8EG 9.8
2020-11-06
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
CVE-2020-27689CRITICALCVSS 9.8EG 9.8
2020-11-04
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on…
CVE-2020-11483CRITICALCVSS 9.8EG 9.8
2020-10-29
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, wh…
CVE-2020-11854CRITICALCVSS 9.8EG 9.8
2020-10-27
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containe…
CVE-2020-26879CRITICALCVSS 9.8EG 9.8
2020-10-26
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
CVE-2020-12501CRITICALCVSS 9.8EG 9.8
2020-10-15
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accoun…
CVE-2020-24218CRITICALCVSS 9.8EG 9.8
2020-10-06
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard-coded in the executable file.

Map vulnerabilities like CWE-798 to your infrastructure

EchelonGraph correlates every CVE — across CWE-798 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →