← Back
CWE-798

1,901 CVEs • Abstraction: Base • Likelihood of Exploit: High

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

JSON object

Loading...

CVEs (1,901)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-125030
1Empress Project
1Empress
Nov 21, 2024
Jan 1, 2023
N/A· v4
9.8 CRITICAL· v3
5.8 MEDIUM· v2
A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified...Show more
A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified as 557e177d8a309d6f0f26de46efb38d43e000852d. It is recommended to apply a patch to fix this issue. VDB-217154 is the identifier assigned to this vulnerability.Show less
CVE-2022-4780
1Elvexys
1Isos Firmware
Jun 17, 2026
Dec 29, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
CVE-2022-45425
1Dahuasecurity
5Dhi Dss4004 S2 Firmware
Dhi Dss7016d S2 FirmwareDhi Dss7016dr S2 Firmware+2 more
Jun 17, 2026
Dec 27, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.
CVE-2022-36222
1Nokia
1Fastmile Firmware
Jun 17, 2026
Dec 21, 2022
N/A· v4
8.4 HIGH· v3
N/A· v2
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.
CVE-2022-4611
1Clickstudios
1Passwordstate
Jun 17, 2026
Dec 19, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. I...Show more
A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.Show less
CVE-2022-37832
1Mutiny
1Mutiny
Jun 17, 2026
Dec 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Mutiny 7.2.0-10788 suffers from Hardcoded root password.
CVE-2021-35252
1Solarwinds
1Serv U
Jun 17, 2026
Dec 16, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.
CVE-2022-41653
1Daikinlatam
2Svmpc1
Svmpc2
Jun 17, 2026
Dec 13, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system.
CVE-2022-2660
1Deltaww
1Dialink
Jun 17, 2026
Dec 13, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data and compromise the machine.
CVE-2022-34840
1Buffalo
9Hw 450hp Zwe Firmware
Wzr 300hp FirmwareWzr 450hp Cwt Firmware+6 more
Jun 17, 2026
Dec 7, 2022
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP f...Show more
Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.Show less
CVE-2022-38337
1Mobatek
1Mobaxterm
Jun 17, 2026
Dec 6, 2022
N/A· v4
9.1 CRITICAL· v3
N/A· v2
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services...Show more
When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.Show less
CVE-2022-40259
1Ami
1Megarac Sp X
Jun 17, 2026
Dec 5, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
MegaRAC Default Credentials Vulnerability
CVE-2022-40242
1Ami
1Megarac Sp X
Jun 17, 2026
Dec 5, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
MegaRAC Default Credentials Vulnerability
CVE-2022-44097
1Book Store Management System Project
1Book Store Management System
Jun 17, 2026
Nov 30, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVE-2022-44096
1Sanitization Management System Project
1Sanitization Management System
Jun 17, 2026
Nov 30, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVE-2022-32967
1Realtek
2Rtl8111ep Cg Firmware
Rtl8111fp Cg Firmware
Jun 17, 2026
Nov 29, 2022
N/A· v4
2.1 LOW· v3
N/A· v2
RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system inform...Show more
RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information.Show less
CVE-2022-41157
1Webcash
1Serp Server 2.0
Jun 17, 2026
Nov 25, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious command...Show more
A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.Show less
CVE-2022-29831
1Mitsubishielectric
1Gx Works3
Jun 17, 2026
Nov 25, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety...Show more
Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.Show less
CVE-2022-29830
1Mitsubishielectric
1Gx Works3
Jun 17, 2026
Nov 25, 2022
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote una...Show more
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally.Show less
CVE-2022-29829
1Mitsubishielectric
1Gx Works3
Jun 17, 2026
Nov 25, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related...Show more
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally.Show less