# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Hardcoded Credentials](https://agentprime.io/advisories/CVE-2024-36496.md)
  `CVE-2024-36496` · CVE record: Faronics WINSelect (Standard + Enterprise) · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2024 · Tags: Hard-coded credentials
- [H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-38902.md)
  `CVE-2024-38902` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in CVE-2024-36480 Ricoh Streamline NX PC Client](https://agentprime.io/advisories/CVE-2024-36480.md)
  `CVE-2024-36480` · CVE record: CVE-2024-36480 Ricoh Streamline NX PC Client · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2024 · Tags: Hard-coded credentials
- [Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)](https://agentprime.io/advisories/CVE-2024-5275.md)
  `CVE-2024-5275` · CVE record: Fortra FileCatalyst Direct and 1 more · CVSS 7.8 High · Not analysed yet · Published 18 Jun 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2024-38505.md)
  `CVE-2024-38505` · CVE record: JetBrains YouTrack · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2024 · Tags: Hard-coded credentials
- [D-Link router - Hidden Backdoor](https://agentprime.io/advisories/CVE-2024-6045.md)
  `CVE-2024-6045` · CVE record: D-Link G403 and 4 more · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2024 · Tags: Hard-coded credentials, CWE-912
- [Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.](https://agentprime.io/advisories/CVE-2024-38466.md)
  `CVE-2024-38466` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2024 · Tags: Hard-coded credentials
- [HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header](https://agentprime.io/advisories/CVE-2024-30119.md)
  `CVE-2024-30119` · CVE record: HCL Software DRYiCE Optibot Reset Station · CVSS 3.7 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Hardcoded credentials for WebDAV access](https://agentprime.io/advisories/CVE-2024-27170.md)
  `CVE-2024-27170` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 7.4 High · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded keys used to generate authentication cookies](https://agentprime.io/advisories/CVE-2024-27168.md)
  `CVE-2024-27168` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 7.1 High · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded credentials](https://agentprime.io/advisories/CVE-2024-27164.md)
  `CVE-2024-27164` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 7.1 High · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password used to encrypt files](https://agentprime.io/advisories/CVE-2024-27161.md)
  `CVE-2024-27161` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 6.2 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password used to encrypt logs and use of weak cipher](https://agentprime.io/advisories/CVE-2024-27160.md)
  `CVE-2024-27160` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 6.2 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password used to encrypt logs](https://agentprime.io/advisories/CVE-2024-27159.md)
  `CVE-2024-27159` · CVE record: Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 6.2 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-37644.md)
  `CVE-2024-37644` · CVE record · CVSS 8.8 High · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.](https://agentprime.io/advisories/CVE-2024-34539.md)
  `CVE-2024-34539` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jun 2024 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)](https://agentprime.io/advisories/CVE-2024-38285.md)
  `CVE-2024-38285` · CVE record: Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) · CVSS 7.0 High · Not analysed yet · Published 13 Jun 2024 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)](https://agentprime.io/advisories/CVE-2024-38282.md)
  `CVE-2024-38282` · CVE record: Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) · CVSS 8.5 High · Not analysed yet · Published 13 Jun 2024 · Tags: Hard-coded credentials
- [Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)](https://agentprime.io/advisories/CVE-2024-38281.md)
  `CVE-2024-38281` · CVE record: Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) · CVSS 8.6 High · Not analysed yet · Published 13 Jun 2024 · Tags: Hard-coded credentials
- [D-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-37630.md)
  `CVE-2024-37630` · CVE record · CVSS 8.8 High · Not analysed yet · Published 13 Jun 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Schneider Electric EcoStruxure IT Gateway](https://agentprime.io/advisories/CVE-2024-0865.md)
  `CVE-2024-0865` · CVE record: Schneider Electric EcoStruxure IT Gateway · CVSS 7.8 High · Not analysed yet · Published 12 Jun 2024 · Tags: Hard-coded credentials
- [Hard-coded password in Hitachi Energy FOXMAN-UN and others](https://agentprime.io/advisories/CVE-2024-28023.md)
  `CVE-2024-28023` · CVE record: Hitachi Energy FOXMAN-UN and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Siemens SINEC Traffic Analyzer](https://agentprime.io/advisories/CVE-2024-35208.md)
  `CVE-2024-35208` · CVE record: Siemens SINEC Traffic Analyzer · CVSS 4.8 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Veeam Recovery Orchestrator](https://agentprime.io/advisories/CVE-2024-29855.md)
  `CVE-2024-29855` · CVE record: Veeam Recovery Orchestrator · CVSS 9.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 11 Jun 2024 · Tags: Hard-coded credentials
- [An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows.](https://agentprime.io/advisories/CVE-2024-26330.md)
  `CVE-2024-26330` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: Hard-coded credentials
- [Docker CLI leaks private registry credentials to registry-1.docker.io](https://agentprime.io/advisories/GHSA-99pg-grm5-qq3v.md)
  `GHSA-99pg-grm5-qq3v`, `BIT-docker-cli-2021-41092`, `CVE-2021-41092`, `GO-2024-2912` · Go `github.com/docker/cli`: affected `<20.10.9`, fixed in `20.10.9` · CVSS 5.4 Medium · Not analysed yet · Published 10 Jun 2024 · Tags: Information disclosure, Hard-coded credentials
- [Insufficiently protected credentials in JetBrains IntelliJ IDEA and others](https://agentprime.io/advisories/CVE-2024-37051.md)
  `CVE-2024-37051` · CVE record: JetBrains IntelliJ IDEA and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password in Estomed Sp. z o.o. Simple Care software](https://agentprime.io/advisories/CVE-2024-3700.md)
  `CVE-2024-3700` · CVE record: Estomed Sp. z o.o. Simple Care · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password in drEryk Gabinet](https://agentprime.io/advisories/CVE-2024-3699.md)
  `CVE-2024-3699` · CVE record: drEryk sp. z o.o. drEryk Gabinet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: Hard-coded credentials
- [Hardcoded password in Eurosoft Przychodnia](https://agentprime.io/advisories/CVE-2024-1228.md)
  `CVE-2024-1228` · CVE record: EuroSoft Sp. z o. o. Eurosoft Przychodnia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2024 · Tags: Hard-coded credentials
- [An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards.](https://agentprime.io/advisories/CVE-2024-36789.md)
  `CVE-2024-36789` · CVE record · CVSS 8.1 High · Not analysed yet · Published 7 Jun 2024 · Tags: Hard-coded credentials
- [Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file.](https://agentprime.io/advisories/CVE-2023-49224.md)
  `CVE-2023-49224` · CVE record · CVSS 8.0 High · Not analysed yet · Published 7 Jun 2024 · Tags: Hard-coded credentials
- [Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd.](https://agentprime.io/advisories/CVE-2023-49223.md)
  `CVE-2023-49223` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Jun 2024 · Tags: Hard-coded credentials
- [Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key.](https://agentprime.io/advisories/CVE-2023-49222.md)
  `CVE-2023-49222` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Jun 2024 · Tags: Hard-coded credentials
- [Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded servi…](https://agentprime.io/advisories/CVE-2023-49221.md)
  `CVE-2023-49221` · CVE record · CVSS 7.8 High · Not analysed yet · Published 7 Jun 2024 · Tags: Hard-coded credentials
- [Authentication bypass in dtale](https://agentprime.io/advisories/GHSA-v9q6-fm48-rx74.md)
  `GHSA-v9q6-fm48-rx74`, `CVE-2024-3408`, `PYSEC-2024-117` · PyPI `dtale`: affected `<=3.10.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.78 · Not analysed yet · Published 6 Jun 2024 · Tags: Hard-coded credentials, CWE-20
- [Password hash exposed in CraftCMS two factor authentication plugin](https://agentprime.io/advisories/GHSA-3p4x-grpm-xw58.md)
  `GHSA-3p4x-grpm-xw58`, `CVE-2024-5657`, `PKSA-nm5q-6rp9-z76s` · Packagist `born05/craft-twofactorauthentication`: affected `>=3.3.1, <3.3.4`, fixed in `3.3.4` · CVSS 3.7 Low · Not analysed yet · Published 6 Jun 2024 · Tags: Information disclosure, Hard-coded credentials, CWE-499
- [apko Exposure of HTTP basic auth credentials in log output](https://agentprime.io/advisories/GHSA-v6mg-7f7p-qmqp.md)
  `GHSA-v6mg-7f7p-qmqp`, `CVE-2024-36127`, `GO-2024-2899` · Go `chainguard.dev/apko`: affected `<0.14.5`, fixed in `0.14.5` · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2024 · Tags: Hard-coded credentials, Information disclosure
- [Hard-coded credentials in Dell PowerScale OneFS](https://agentprime.io/advisories/CVE-2024-29170.md)
  `CVE-2024-29170` · CVE record: Dell PowerScale OneFS · CVSS 8.1 High · Not analysed yet · Published 4 Jun 2024 · Tags: Hard-coded credentials
- [TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-36782.md)
  `CVE-2024-36782` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2024 · Tags: Hard-coded credentials
- [Vulnerability in Welch Allyn Configuration Tool Software](https://agentprime.io/advisories/CVE-2024-5176.md)
  `CVE-2024-5176` · CVE record: Baxter Welch Allyn Configuration Tool · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 May 2024 · Tags: Hard-coded credentials
- [LenelS2 NetBox Hardcoded Credentials](https://agentprime.io/advisories/CVE-2024-2420.md)
  `CVE-2024-2420` · CVE record: LenelS2 NetBox · CVSS 8.8 High · Not analysed yet · Published 30 May 2024 · Tags: Hard-coded credentials
- [MinMax CMS - Hidden Functionality](https://agentprime.io/advisories/CVE-2024-5514.md)
  `CVE-2024-5514` · CVE record: MinMax Digital Technology MinMax CMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2024 · Tags: Hard-coded credentials, CWE-912
- [SimpleSAMLphp exposes credentials in session storage](https://agentprime.io/advisories/GHSA-7wh8-jrq7-p27f.md)
  `GHSA-7wh8-jrq7-p27f`, `PKSA-ytw1-2sfw-nwys` · Packagist `simplesamlphp/simplesamlphp`: affected `>=1.16.0, <1.16.3`, fixed in `1.16.3` · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2024 · Tags: Hard-coded credentials
- [Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device.](https://agentprime.io/advisories/CVE-2024-35344.md)
  `CVE-2024-35344` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2024 · Tags: Hard-coded credentials
- [ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.](https://agentprime.io/advisories/CVE-2024-33849.md)
  `CVE-2024-33849` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2024 · Tags: Hard-coded credentials, CWE-657
- [Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the database server, using an unencrypted conne…](https://agentprime.io/advisories/CVE-2024-36049.md)
  `CVE-2024-36049` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2024 · Tags: Hard-coded credentials
- [TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-35395.md)
  `CVE-2024-35395` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 May 2024 · Tags: Hard-coded credentials
- [D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2024-5296.md)
  `CVE-2024-5296` · CVE record: D-Link D-View · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2024 · Tags: Hard-coded credentials
- [Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentials](https://agentprime.io/advisories/CVE-2024-2038.md)
  `CVE-2024-2038` · CVE record: wpfeedback Atarim – Visual Feedback, Review & AI Collaboration · CVSS 7.5 High · Not analysed yet · Published 23 May 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in i-plug inc. 'OfferBox' App for Android and others](https://agentprime.io/advisories/CVE-2024-32988.md)
  `CVE-2024-32988` · CVE record: i-plug inc. 'OfferBox' App for Android and 1 more · CVSS 7.5 High · Not analysed yet · Published 22 May 2024 · Tags: Hard-coded credentials
- [Trivy possibly leaks registry credential when scanning images from malicious registries](https://agentprime.io/advisories/GHSA-xcq4-m2r3-cmrj.md)
  `GHSA-xcq4-m2r3-cmrj`, `CVE-2024-35192`, `GO-2024-2870` · Go `github.com/aquasecurity/trivy`: affected `<0.51.2`, fixed in `0.51.2` · CVSS 5.5 Medium · Not analysed yet · Published 20 May 2024 · Tags: Hard-coded credentials
- [Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.](https://agentprime.io/advisories/CVE-2024-36081.md)
  `CVE-2024-36081` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2024 · Tags: Hard-coded credentials, CWE-256
- [HCL BigFix Platform is susceptible to insufficiently protected credentials](https://agentprime.io/advisories/CVE-2024-23583.md)
  `CVE-2024-23583` · CVE record: HCL Software BigFix Platform · CVSS 6.7 Medium · Not analysed yet · Published 17 May 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Trellix ePolicy Orchestrator](https://agentprime.io/advisories/CVE-2024-4844.md)
  `CVE-2024-4844` · CVE record: Trellix ePolicy Orchestrator · CVSS 7.5 High · Not analysed yet · Published 16 May 2024 · Tags: Hard-coded credentials
- [CyberPower PowerPanel business Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2024-31410.md)
  `CVE-2024-31410` · CVE record: CyberPower PowerPanel business · CVSS 7.7 High · Not analysed yet · Published 15 May 2024 · Tags: Hard-coded credentials
- [CyberPower PowerPanel business Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2024-32053.md)
  `CVE-2024-32053` · CVE record: CyberPower PowerPanel business · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2024 · Tags: Hard-coded credentials
- [CyberPower PowerPanel business Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2024-33625.md)
  `CVE-2024-33625` · CVE record: CyberPower PowerPanel business · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2024 · Tags: Hard-coded credentials
- [CyberPower PowerPanel business Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2024-34025.md)
  `CVE-2024-34025` · CVE record: CyberPower PowerPanel business · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2024 · Tags: Hard-coded credentials
- [Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins](https://agentprime.io/advisories/GHSA-jv32-5578-pxjc.md)
  `GHSA-jv32-5578-pxjc`, `BIT-grafana-2022-31130`, `CVE-2022-31130`, `GO-2024-2851` · Go `github.com/grafana/grafana`: affected `>=7.0.0, <8.5.14 || >=9.0.0, <9.1.8`, fixed in `8.5.14`, `9.1.8` · CVSS 4.9 Medium · Not analysed yet · Published 14 May 2024 · Tags: Information disclosure, Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI0LTA1LTE0VDIyOjI1OjI2LjAwMDAwMFoiLCJHSFNBLWp2MzItNTU3OC1weGpjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI0LTA2LTI1VDAxOjM0OjU2LjU2NzAwMFoiLCJDVkUtMjAyMy02MTk4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI0LTA2LTI1VDAxOjM0OjU2LjU2NzAwMFoiLCJDVkUtMjAyMy02MTk4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.