CWE-798— Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.— MITRE CWE catalog

1,950 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-798page 37 of 39

CVE-2022-29960MEDIUMCVSS 5.5EG 5.5
2022-07-26
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, e…
CVE-2022-25807MEDIUMCVSS 5.5EG 5.5
2022-06-09
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has discovered encrypted LDAP bind credentials, to decrypt those credentials using a…
CVE-2021-43575MEDIUMCVSS 5.5EG 5.5
2021-11-09
KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the…
CVE-2021-41320MEDIUMCVSS 5.5EG 5.5
2021-10-15
A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed d…
CVE-2021-36234MEDIUMCVSS 5.5EG 5.5
2021-08-31
Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
CVE-2021-27481MEDIUMCVSS 5.5EG 5.5
2021-06-16
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allow an attacker to gain access to sensitive information.
CVE-2021-26579MEDIUMCVSS 5.5EG 5.5
2021-03-30
A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptographic Key in a product). HPE has provided updates to versions 1.2009.0 and 1.2101.…
CVE-2020-12376MEDIUMCVSS 5.5EG 5.5
2021-02-17
Use of hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow authenticated user to potentially enable information disclosure via local access.
CVE-2020-0019MEDIUMCVSS 5.5EG 5.5
2020-12-14
In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: A…
CVE-2020-25231MEDIUMCVSS 5.5EG 5.5
2020-12-14
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of program data for the affected devices uses a static key. An attacker could use thi…
CVE-2020-5667MEDIUMCVSS 5.5EG 5.5
2020-11-06
Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing dat…
CVE-2019-16150MEDIUMCVSS 5.5EG 5.5
2020-06-04
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file t…
CVE-2020-11723MEDIUMCVSS 5.5EG 5.5
2020-04-14
Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place evidence onto target devices when performing a forensic extraction.
CVE-2019-5106MEDIUMCVSS 5.5EG 5.5
2020-03-11
A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of a…
CVE-2020-6857MEDIUMCVSS 5.5EG 5.5
2020-01-21
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.
CVE-2019-4309MEDIUMCVSS 5.5EG 5.5
2019-10-29
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM X-Force ID: 161035.
CVE-2019-4220MEDIUMCVSS 5.5EG 5.5
2019-06-06
IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229.
CVE-2021-34757MEDIUMCVSS 4.9EG 5.5
2021-10-06
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more informatio…
CVE-2023-21426MEDIUMCVSS 4.3EG 5.5
2023-02-09
Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.
CVE-2026-71396MEDIUMCVSS 5.4EG 5.4
2026-08-27
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
CVE-2026-76392MEDIUMCVSS 5.4EG 5.4
2026-08-19
In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because…
CVE-2026-63239MEDIUMCVSS 5.4EG 5.4
2026-07-29
A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interce…
CVE-2024-57790MEDIUMCVSS 5.4EG 5.4
2025-02-14
IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vulnerability allows physically proximate attackers to gain root access via UART or…
CVE-2024-50692MEDIUMCVSS 5.4EG 5.4
2025-01-24
SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to …
CVE-2024-21990MEDIUMCVSS 5.4EG 5.4
2024-04-17
ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials.
CVE-2023-25823MEDIUMCVSS 5.4EG 5.4
2023-02-23
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and …
CVE-2026-7003MEDIUMCVSS 5.3EG 5.3
2026-10-30
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in p…
CVE-2026-87950MEDIUMCVSS 5.3EG 5.3
2026-10-22
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-53986MEDIUMCVSS 5.3EG 5.3
2026-10-21
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting…
CVE-2026-108584MEDIUMCVSS 5.3EG 5.3
2026-10-11
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the a…
CVE-2026-67104MEDIUMCVSS 5.3EG 5.3
2026-10-01
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoi…
CVE-2026-77960MEDIUMCVSS 5.3EG 5.3
2026-09-18
Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.
CVE-2026-85149MEDIUMCVSS 5.3EG 5.3
2026-09-04
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby brows…
CVE-2026-76131MEDIUMCVSS 5.3EG 5.3
2026-08-21
Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.
CVE-2026-47847MEDIUMCVSS 5.3EG 5.3
2026-06-18
Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment vari…
CVE-2026-48245MEDIUMCVSS 5.3EG 5.3
2026-05-21
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform…
CVE-2026-48244MEDIUMCVSS 5.3EG 5.3
2026-05-21
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Pl…
CVE-2026-48243MEDIUMCVSS 5.3EG 5.3
2026-05-21
Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-pa…
CVE-2026-4216MEDIUMCVSS 5.3EG 5.3
2026-03-16
A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally.…
CVE-2024-55023MEDIUMCVSS 5.3EG 5.3
2026-03-03
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.
CVE-2025-54341MEDIUMCVSS 5.3EG 5.3
2025-11-24
A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.
CVE-2025-64766MEDIUMCVSS 5.3EG 5.3
2025-11-17
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the…
CVE-2025-58659MEDIUMCVSS 5.3EG 5.3
2025-09-22
Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.
CVE-2025-58656MEDIUMCVSS 5.3EG 5.3
2025-09-22
Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for Woo…
CVE-2025-58269MEDIUMCVSS 5.3EG 5.3
2025-09-22
Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.
CVE-2024-13688MEDIUMCVSS 5.3EG 5.3
2025-04-28
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
CVE-2025-2342MEDIUMCVSS 5.3EG 5.3
2025-03-16
A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpoint. The manipulation leads to hard-coded credentials. It is possible to launch …
CVE-2024-48007MEDIUMCVSS 5.3EG 5.3
2024-12-13
Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these…
CVE-2024-4740MEDIUMCVSS 5.3EG 5.3
2024-10-18
MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data.
CVE-2024-45165MEDIUMCVSS 5.3EG 5.3
2024-08-22
An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived from the string "(c)2007 UCI Software GmbH B.Boll" (without quotes). The key is …

Map vulnerabilities like CWE-798 to your infrastructure

EchelonGraph correlates every CVE — across CWE-798 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →