# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Insufficiently protected credentials in GE HealthCare EchoPAC products](https://agentprime.io/advisories/CVE-2024-27109.md)
  `CVE-2024-27109` · CVE record: GE HealthCare EchoPAC Software Only and 2 more · CVSS 7.6 High · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Weak account password in GE HealthCare EchoPAC products](https://agentprime.io/advisories/CVE-2024-27107.md)
  `CVE-2024-27107` · CVE record: GE HealthCare EchoPAC Software Only and 2 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [An issue was discovered in linqi before 1.4.0.1 on Windows.](https://agentprime.io/advisories/CVE-2024-33867.md)
  `CVE-2024-33867` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2024-33497.md)
  `CVE-2024-33497` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 4.8 Medium · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2024-33496.md)
  `CVE-2024-33496` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 4.8 Medium · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Hard-coded password in Siemens SIMATIC CN 4100](https://agentprime.io/advisories/CVE-2024-32741.md)
  `CVE-2024-32741` · CVE record: Siemens SIMATIC CN 4100 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Siemens SIMATIC CN 4100](https://agentprime.io/advisories/CVE-2024-32740.md)
  `CVE-2024-32740` · CVE record: Siemens SIMATIC CN 4100 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2024-30207.md)
  `CVE-2024-30207` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2024 · Tags: Hard-coded credentials
- [TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.](https://agentprime.io/advisories/CVE-2024-31810.md)
  `CVE-2024-31810` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2024 · Tags: Hard-coded credentials
- [Improper authentication in YMS VIS Pro](https://agentprime.io/advisories/CVE-2024-3263.md)
  `CVE-2024-3263` · CVE record: YMS VIS Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2024 · Tags: Authentication bypass, Hard-coded credentials
- [IBM TXSeries for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2024-22345.md)
  `CVE-2024-22345` · CVE record: IBM TXSeries for Multiplatforms · CVSS 6.2 Medium · Not analysed yet · Published 10 May 2024 · Tags: Hard-coded credentials
- [Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal c…](https://agentprime.io/advisories/CVE-2023-26566.md)
  `CVE-2023-26566` · CVE record · CVSS 8.6 High · Not analysed yet · Published 10 May 2024 · Tags: Hard-coded credentials
- [TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-34211.md)
  `CVE-2024-34211` · CVE record · CVSS 8.8 High · Not analysed yet · Published 9 May 2024 · Tags: Hard-coded credentials
- [TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.](https://agentprime.io/advisories/CVE-2024-34219.md)
  `CVE-2024-34219` · CVE record · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 9 May 2024 · Tags: Hard-coded credentials
- [SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-23473.md)
  `CVE-2024-23473` · CVE record: SolarWinds Access Rights Manager · CVSS 8.6 High · Not analysed yet · Published 9 May 2024 · Tags: Hard-coded credentials
- [VMware Avi Load Balancer updates address multiple vulnerabilities](https://agentprime.io/advisories/CVE-2024-22266.md)
  `CVE-2024-22266` · CVE record: VMware VMware Avi Load Balancer · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2024 · Tags: Hard-coded credentials
- [HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint](https://agentprime.io/advisories/CVE-2024-23551.md)
  `CVE-2024-23551` · CVE record: HCL Software BigFix Compliance · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2024 · Tags: Hard-coded credentials
- [Weak password requirements in Ubiquiti Inc Update UniFi Connect EV Station and others](https://agentprime.io/advisories/CVE-2024-29208.md)
  `CVE-2024-29208` · CVE record: Ubiquiti Inc Update UniFi Connect EV Station and 3 more · CVSS 2.2 Low · Not analysed yet · Published 7 May 2024 · Tags: Hard-coded credentials
- [Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure](https://agentprime.io/advisories/GHSA-2x52-8f29-7cjr.md)
  `GHSA-2x52-8f29-7cjr`, `CVE-2024-4536` · Maven `org.eclipse.edc:connector-core`: affected `>=0.2.1, <0.6.3`, fixed in `0.6.3` · CVSS 6.8 Medium · Not analysed yet · Published 7 May 2024 · Tags: Information disclosure, Hard-coded credentials
- [Credential Cloning](https://agentprime.io/advisories/CVE-2024-29941.md)
  `CVE-2024-29941` · CVE record: Integrated Control Technology TSEC · CVSS 8.0 High · Not analysed yet · Published 6 May 2024 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Motorola Phones](https://agentprime.io/advisories/CVE-2024-3109.md)
  `CVE-2024-3109` · CVE record: Motorola Phones · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-51629.md)
  `CVE-2023-51629` · CVE record: D-Link DCS-8300LHV2 · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2023-51588.md)
  `CVE-2023-51588` · CVE record: Voltronic Power ViewPower Pro · CVSS 7.8 High · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-44411.md)
  `CVE-2023-44411` · CVE record: D-Link D-View · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-39482.md)
  `CVE-2023-39482` · CVE record: Softing Secure Integration Server · CVSS 4.9 Medium · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-39465.md)
  `CVE-2023-39465` · CVE record: Triangle MicroWorks SCADA Data Gateway · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-39458.md)
  `CVE-2023-39458` · CVE record: Triangle MicroWorks SCADA Data Gateway · CVSS 5.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-35724.md)
  `CVE-2023-35724` · CVE record: D-Link DAP-2622 · CVSS 8.8 High · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-34284.md)
  `CVE-2023-34284` · CVE record: NETGEAR RAX30 · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-32169.md)
  `CVE-2023-32169` · CVE record: D-Link D-View · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.56 · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-32145.md)
  `CVE-2023-32145` · CVE record: D-Link DAP-1360 · CVSS 8.8 High · Not analysed yet · Published 3 May 2024 · Tags: Hard-coded credentials
- [Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext](https://agentprime.io/advisories/GHSA-94pr-w968-h923.md)
  `GHSA-94pr-w968-h923`, `CVE-2024-34147` · Maven `org.jenkins-ci.plugins:telegrambot`: affected `<=1.4.0`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 2 May 2024 · Tags: Hard-coded credentials
- [LoadMaster Hardcoded SSH Key](https://agentprime.io/advisories/CVE-2024-3544.md)
  `CVE-2024-3544` · CVE record: Progress Software Corporation LoadMaster · CVSS 7.5 High · Not analysed yet · Published 2 May 2024 · Tags: Hard-coded credentials
- [Hard-coded password in SonicWall GMS](https://agentprime.io/advisories/CVE-2024-29011.md)
  `CVE-2024-29011` · CVE record: SonicWall GMS · CVSS 7.5 High · Not analysed yet · Published 1 May 2024 · Tags: Hard-coded credentials
- [The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords.](https://agentprime.io/advisories/CVE-2024-32213.md)
  `CVE-2024-32213` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2024 · Tags: Hard-coded credentials
- [The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL connections.](https://agentprime.io/advisories/CVE-2024-32210.md)
  `CVE-2024-32210` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2024 · Tags: Hard-coded credentials
- [HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.…](https://agentprime.io/advisories/CVE-2019-19754.md)
  `CVE-2019-19754` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 30 Apr 2024 · Tags: Hard-coded credentials
- [SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.i…](https://agentprime.io/advisories/CVE-2019-19753.md)
  `CVE-2019-19753` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2024 · Tags: Hard-coded credentials
- [nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io.](https://agentprime.io/advisories/CVE-2019-19752.md)
  `CVE-2019-19752` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2024 · Tags: Hard-coded credentials
- [In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.](https://agentprime.io/advisories/CVE-2023-52723.md)
  `CVE-2023-52723` · CVE record · CVSS 7.1 High · Not analysed yet · Published 29 Apr 2024 · Tags: Hard-coded credentials
- [Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx.](https://agentprime.io/advisories/CVE-2024-33891.md)
  `CVE-2024-33891` · CVE record · CVSS 8.8 High · Not analysed yet · Published 28 Apr 2024 · Tags: Hard-coded credentials
- [Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.](https://agentprime.io/advisories/CVE-2024-28325.md)
  `CVE-2024-28325` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 26 Apr 2024 · Tags: Hard-coded credentials, CWE-256
- [H3C ER8300G2-X is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2024-32238.md)
  `CVE-2024-32238` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.53 · Not analysed yet · Published 22 Apr 2024 · Tags: Hard-coded credentials
- [An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting network connectivity between the router and…](https://agentprime.io/advisories/CVE-2024-22813.md)
  `CVE-2024-22813` · CVE record · CVSS 4.4 Medium · Not analysed yet · Published 22 Apr 2024 · Tags: Hard-coded credentials
- [IBM Aspera Faspex privilege escalation](https://agentprime.io/advisories/CVE-2023-37400.md)
  `CVE-2023-37400` · CVE record: IBM Aspera Faspex · CVSS 7.8 High · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials
- [hard-coded credentials in the documentation that appear as the appliance root password](https://agentprime.io/advisories/CVE-2024-29966.md)
  `CVE-2024-29966` · CVE record: Brocade Brocade SANnav · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials
- [Brocade SANnav contains hardcoded TLS keys used by Docker](https://agentprime.io/advisories/CVE-2024-29963.md)
  `CVE-2024-29963` · CVE record: Brocade Brocade SANnav · CVSS 1.9 Low · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials
- [Identical SSH keys utilized inside the OVA image (CVE-2024-29960)](https://agentprime.io/advisories/CVE-2024-29960.md)
  `CVE-2024-29960` · CVE record: Brocade Brocade SANnav · CVSS 6.8 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials
- [DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control.](https://agentprime.io/advisories/CVE-2023-49963.md)
  `CVE-2023-49963` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Apr 2024 · Tags: Hard-coded credentials
- [Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility](https://agentprime.io/advisories/CVE-2024-21990.md)
  `CVE-2024-21990` · CVE record: NetApp ONTAP Select Deploy administration utility · CVSS 5.4 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Hard-coded credentials
- [Smart Office Main.aspx weak password](https://agentprime.io/advisories/CVE-2024-3735.md)
  `CVE-2024-3735` · CVE record: Smart Office · CVSS 6.3 Medium · Not analysed yet · Published 13 Apr 2024 · Tags: Hard-coded credentials
- [\[Child CVE\] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks](https://agentprime.io/advisories/CVE-2024-30407.md)
  `CVE-2024-30407` · CVE record: Juniper Networks, Inc. cRPD and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Apr 2024 · Tags: Hard-coded credentials
- [IBM Security Verify Access Appliance information disclosure](https://agentprime.io/advisories/CVE-2024-31873.md)
  `CVE-2024-31873` · CVE record: IBM Security Verify Access Appliance · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2024 · Tags: Hard-coded credentials
- [Azure Identity Library for .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-wvxc-855f-jvrv.md)
  `GHSA-wvxc-855f-jvrv`, `CVE-2024-29992` · NuGet `Azure.Identity`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 5.5 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Hard-coded credentials
- [Azure AI Search Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-29063.md)
  `CVE-2024-29063` · CVE record: Microsoft Azure AI Search · CVSS 7.3 High · Not analysed yet · Published 9 Apr 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2023-41677.md)
  `CVE-2023-41677` · CVE record: Fortinet FortiOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2024 · Tags: Hard-coded credentials
- [In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).](https://agentprime.io/advisories/CVE-2024-28066.md)
  `CVE-2024-28066` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2024 · Tags: Hard-coded credentials
- [Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information.](https://agentprime.io/advisories/CVE-2024-27488.md)
  `CVE-2024-27488` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2024 · Tags: Hard-coded credentials
- [D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials](https://agentprime.io/advisories/CVE-2024-3272.md)
  `CVE-2024-3272` · CVE record: D-Link DNS-320L and 3 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 4 Apr 2024 · Tags: Hard-coded credentials
- [Insecure Data Storage leading to sensitive Information disclosure.](https://agentprime.io/advisories/CVE-2024-3130.md)
  `CVE-2024-3130` · CVE record: CoolKIt eWeLink APP · CVSS 5.7 Medium · Not analysed yet · Published 1 Apr 2024 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI0LTA0LTAxVDA5OjEzOjUzLjA4MjAwMFoiLCJDVkUtMjAyNC0zMTMwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI0LTA1LTE0VDIyOjI1OjI2LjAwMDAwMFoiLCJHSFNBLWp2MzItNTU3OC1weGpjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI0LTA1LTE0VDIyOjI1OjI2LjAwMDAwMFoiLCJHSFNBLWp2MzItNTU3OC1weGpjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.