CWE-798— Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.— MITRE CWE catalog

1,982 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-798page 31 of 40

CVE-2017-7537HIGHCVSS 5.9EG 7.5
2018-07-26
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process …
CVE-2019-13543HIGHCVSS 5.8EG 7.5
2019-11-08
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard…
CVE-2022-30627HIGHCVSS 5.7EG 7.5
2022-07-18
This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it po…
CVE-2022-29825HIGHCVSS 5.6EG 7.5
2022-11-25
Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticate…
CVE-2022-39273HIGHCVSS 4.8EG 7.5
2022-10-06
FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make e…
CVE-2014-2350HIGHCVSS v2 7.5EG 7.5
2014-05-22
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet pro…
CVE-2006-7074HIGHCVSS v2 7.5EG 7.5
2007-03-02
admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie.
CVE-2000-1139HIGHCVSS v2 7.5EG 7.5
2001-01-09
The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, aka the "Exchange User Account" vulnerability.
CVE-2026-114219HIGHCVSS 7.4EG 7.4
2026-10-22
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext accoun…
CVE-2026-112146HIGHCVSS 7.4EG 7.4
2026-10-19
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to l…
CVE-2025-1724HIGHCVSS 7.4EG 7.4
2025-03-17
Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.
CVE-2024-27170HIGHCVSS 7.4EG 7.4
2024-06-14
It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the refe…
CVE-2024-23842HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22772HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22771HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22770HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22769HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2024-22768HIGHCVSS 7.4EG 7.4
2024-01-23
Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
CVE-2023-26219HIGHCVSS 7.4EG 7.4
2023-10-25
The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoreticall…
CVE-2023-45226HIGHCVSS 7.4EG 7.4
2023-10-10
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server …
CVE-2023-37426HIGHCVSS 7.4EG 7.4
2023-08-22
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature …
CVE-2022-31460HIGHCVSS 7.4EG 7.4
2022-06-02
Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.
CVE-2022-24860HIGHCVSS 7.4EG 7.4
2022-04-20
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in…
CVE-2021-45521HIGHCVSS 7.4EG 7.4
2021-12-26
Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10.
CVE-2018-18979HIGHCVSS 7.4EG 7.4
2019-05-06
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction of the initialization vector is necessary for deciphering communications betwee…
CVE-2018-18978HIGHCVSS 7.4EG 7.4
2019-05-06
An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this applica…
CVE-2018-10328HIGHCVSS 7.4EG 7.4
2018-04-24
Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.
CVE-2026-110667HIGHCVSS 7.3EG 7.3
2026-10-14
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can…
CVE-2026-105147HIGHCVSS 7.3EG 7.3
2026-10-04
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credential…
CVE-2026-101052HIGHCVSS 7.3EG 7.3
2026-09-28
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input …
CVE-2026-93970HIGHCVSS 7.3EG 7.3
2026-09-20
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. T…
CVE-2026-93969HIGHCVSS 7.3EG 7.3
2026-09-20
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be car…
CVE-2026-90509HIGHCVSS 7.3EG 7.3
2026-09-13
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The at…
CVE-2026-86673HIGHCVSS 7.3EG 7.3
2026-09-08
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connecti…
CVE-2026-86276HIGHCVSS 7.3EG 7.3
2026-09-07
A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack c…
CVE-2026-82808HIGHCVSS 7.3EG 7.3
2026-08-31
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation…
CVE-2026-78062HIGHCVSS 7.3EG 7.3
2026-08-23
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to…
CVE-2026-6374HIGHCVSS 7.3EG 7.3
2026-08-10
Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.
CVE-2026-8876HIGHCVSS 7.3EG 7.3
2026-06-03
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.
CVE-2026-36538HIGHCVSS 7.3EG 7.3
2026-05-27
Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authentic…
CVE-2026-8032HIGHCVSS 7.3EG 7.3
2026-05-06
A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. This manipulation of the argument ADMIN_KEY causes hard-coded credentials. The att…
CVE-2026-7579HIGHCVSS 7.3EG 7.3
2026-05-01
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded creden…
CVE-2026-6574HIGHCVSS 7.3EG 7.3
2026-04-19
A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded…
CVE-2025-15605HIGHCVSS 7.3EG 7.3
2026-03-23
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, …
CVE-2026-29023HIGHCVSS 7.3EG 7.3
2026-03-09
Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the …
CVE-2025-13252HIGHCVSS 7.3EG 7.3
2025-11-16
A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functionality of the component RSA/OAuth2/Database. The manipulation results in hard-code…
CVE-2025-32889HIGHCVSS 7.3EG 7.3
2025-05-01
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVE-2025-32888HIGHCVSS 7.3EG 7.3
2025-05-01
An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is hardcoded in the app.
CVE-2025-2322HIGHCVSS 7.3EG 7.3
2025-03-15
A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java.…
CVE-2024-13773HIGHCVSS 7.3EG 7.3
2025-03-14
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenti…

Map vulnerabilities like CWE-798 to your infrastructure

EchelonGraph correlates every CVE — across CWE-798 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →