# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Insufficiently protected credentials in Hewlett Packard Enterprise HPE OneView](https://agentprime.io/advisories/CVE-2023-6573.md)
  `CVE-2023-6573` · CVE record: Hewlett Packard Enterprise HPE OneView · CVSS 5.5 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Hard-coded credentials
- [Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access.](https://agentprime.io/advisories/CVE-2024-23726.md)
  `CVE-2024-23726` · CVE record · CVSS 8.8 High · Not analysed yet · Published 21 Jan 2024 · Tags: Hard-coded credentials
- [Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring](https://agentprime.io/advisories/GHSA-9rhq-86fm-qxqc.md)
  `GHSA-9rhq-86fm-qxqc` · Maven `org.folio:mod-data-export-spring`: affected `<1.5.4 || >=2.0.0, <3.0.0`, fixed in `1.5.4`, `3.0.0` · CVSS 9.1 Critical · Withdrawn · Not analysed yet · Published 20 Jan 2024 · Tags: Hard-coded credentials
- [Duplicate Advisory: Hard-coded credentials in org.folio:mod-remote-storage](https://agentprime.io/advisories/GHSA-hv5g-q4h3-64q4.md)
  `GHSA-hv5g-q4h3-64q4` · Maven `org.folio:mod-remote-storage`: affected `>=2.0.0, <2.0.3 || <1.7.2`, fixed in `2.0.3`, `1.7.2` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 19 Jan 2024 · Tags: Hard-coded credentials
- [EverShop at risk to unauthorized access via weak HMAC secret](https://agentprime.io/advisories/GHSA-32r3-57hp-cgfw.md)
  `GHSA-32r3-57hp-cgfw`, `CVE-2023-46943` · npm `@evershop/evershop`: affected `<1.0.0-rc.9`, fixed in `1.0.0-rc.9` · CVSS 7.4 High · Not analysed yet · Published 13 Jan 2024 · Tags: Broken access control, Hard-coded credentials
- [Hard-coded password for UDS services](https://agentprime.io/advisories/CVE-2023-28897.md)
  `CVE-2023-28897` · CVE record: JOYNEXT MIB3 Infotainment Unit · CVSS 4.0 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: Hard-coded credentials
- [Predictable encryption passphrase used in publicly accessible configuration file](https://agentprime.io/advisories/CVE-2023-49256.md)
  `CVE-2023-49256` · CVE record: Hongdian H8951-4G-ESP · CVSS 7.5 High · Not analysed yet · Published 12 Jan 2024 · Tags: Hard-coded credentials
- [Predefined root password](https://agentprime.io/advisories/CVE-2023-49253.md)
  `CVE-2023-49253` · CVE record: Hongdian H8951-4G-ESP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2024 · Tags: Hard-coded credentials
- [A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.](https://agentprime.io/advisories/CVE-2023-50125.md)
  `CVE-2023-50125` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Hard-coded credentials
- [Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials.](https://agentprime.io/advisories/CVE-2023-50124.md)
  `CVE-2023-50124` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in PTC's Kepware KEPServerEX](https://agentprime.io/advisories/CVE-2023-29447.md)
  `CVE-2023-29447` · CVE record: PTC Kepware KEPServerEX and 2 more · CVSS 5.7 Medium · Not analysed yet · Published 10 Jan 2024 · Tags: Hard-coded credentials
- [Weak credentials in Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and others](https://agentprime.io/advisories/CVE-2023-48257.md)
  `CVE-2023-48257` · CVE record: Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and others](https://agentprime.io/advisories/CVE-2023-48251.md)
  `CVE-2023-48251` · CVE record: Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and 4 more · CVSS 8.1 High · Not analysed yet · Published 10 Jan 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and others](https://agentprime.io/advisories/CVE-2023-48250.md)
  `CVE-2023-48250` · CVE record: Rexroth Nexo cordless nutrunner NXA015S-36V (0608842001) and 4 more · CVSS 8.1 High · Not analysed yet · Published 10 Jan 2024 · Tags: Hard-coded credentials
- [SourceCodester Engineers Online Portal signup_teacher.php weak password](https://agentprime.io/advisories/CVE-2024-0347.md)
  `CVE-2024-0347` · CVE record: SourceCodester Engineers Online Portal · CVSS 3.7 Low · Not analysed yet · Published 9 Jan 2024 · Tags: Hard-coded credentials
- [In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a \~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local sys...](https://agentprime.io/advisories/GHSA-g777-crp9-m27g.md)
  `GHSA-g777-crp9-m27g`, `CVE-2023-50974`, `PYSEC-2024-2` · PyPI `appwrite`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: Hard-coded credentials
- [In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password.](https://agentprime.io/advisories/CVE-2023-49238.md)
  `CVE-2023-49238` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2024 · Tags: Hard-coded credentials
- [IBM Storage Fusion HCI information disclosure](https://agentprime.io/advisories/CVE-2023-50948.md)
  `CVE-2023-50948` · CVE record: IBM Storage Fusion HCI · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2024 · Tags: Hard-coded credentials
- [An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its…](https://agentprime.io/advisories/CVE-2023-37608.md)
  `CVE-2023-37608` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Jan 2024 · Tags: Hard-coded credentials
- [Predictable SSH credentials in Priva TopControl Suite](https://agentprime.io/advisories/CVE-2022-3010.md)
  `CVE-2022-3010` · CVE record: Priva TopControl Suite - Bacnet and 4 more · CVSS 7.5 High · Not analysed yet · Published 2 Jan 2024 · Tags: Hard-coded credentials
- [RRJ Nueva Ecija Engineer Online Portal change_password_teacher.php weak password](https://agentprime.io/advisories/CVE-2024-0188.md)
  `CVE-2024-0188` · CVE record: RRJ Nueva Ecija Engineer Online Portal · CVSS 3.1 Low · Not analysed yet · Published 2 Jan 2024 · Tags: Hard-coded credentials
- [In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass.](https://agentprime.io/advisories/CVE-2023-40236.md)
  `CVE-2023-40236` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 25 Dec 2023 · Tags: Hard-coded credentials
- [PHPGurukul Online Notes Sharing System signup.php weak password](https://agentprime.io/advisories/CVE-2023-7053.md)
  `CVE-2023-7053` · CVE record: PHPGurukul Online Notes Sharing System · CVSS 3.1 Low · Not analysed yet · Published 22 Dec 2023 · Tags: Hard-coded credentials
- [IBM Security Guardium Key Lifecycle Manager information disclosure](https://agentprime.io/advisories/CVE-2023-47704.md)
  `CVE-2023-47704` · CVE record: IBM Security Guardium Key Lifecycle Manager · CVSS 4.0 Medium · Not analysed yet · Published 20 Dec 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Paxton Net2](https://agentprime.io/advisories/CVE-2023-43870.md)
  `CVE-2023-43870` · CVE record: Paxton Net2 · CVSS 8.1 High · Not analysed yet · Published 19 Dec 2023 · Tags: Hard-coded credentials
- [Kaifa Technology WebITR - Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2023-48392.md)
  `CVE-2023-48392` · CVE record: Kaifa Technology WebITR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2023 · Tags: Hard-coded credentials
- [Multisuns EasyLog web+ - Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2023-48388.md)
  `CVE-2023-48388` · CVE record: Multisuns EasyLog web+ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2023 · Tags: Hard-coded credentials
- [SmartStar Software CWS Web-Base - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-48374.md)
  `CVE-2023-48374` · CVE record: SmartStar Software CWS Web-Base · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Zoom Video Communications, Inc. Zoom Mobile App for Android…](https://agentprime.io/advisories/CVE-2023-43583.md)
  `CVE-2023-43583` · CVE record: Zoom Video Communications, Inc. Zoom Mobile App for Android, Zoom Mobile App for iOS and Zoom SDK · CVSS 4.9 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Hard-coded credentials
- [Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-6r5w-jjr5-qvgr.md)
  `GHSA-6r5w-jjr5-qvgr`, `CVE-2023-50770` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.229.vf736b`, fixed in `4.229.vf736b` · CVSS 6.7 Medium · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure, Hard-coded credentials
- [SENEC: Storage Box V1,V2 and V3 using default credentials](https://agentprime.io/advisories/CVE-2023-39169.md)
  `CVE-2023-39169` · CVE record: SENEC Storage Box V1 and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Dec 2023 · Tags: Hard-coded credentials
- [NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.](https://agentprime.io/advisories/CVE-2023-40300.md)
  `CVE-2023-40300` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Dec 2023 · Tags: Hard-coded credentials
- [Administrator equivalent Filr user can access proxy administrator credentials](https://agentprime.io/advisories/CVE-2023-32268.md)
  `CVE-2023-32268` · CVE record: OpenText Filr · CVSS 7.2 High · Not analysed yet · Published 6 Dec 2023 · Tags: Hard-coded credentials
- [Data leak of password hash through change requests](https://agentprime.io/advisories/GHSA-2fr7-cc7p-p45q.md)
  `GHSA-2fr7-cc7p-p45q`, `CVE-2023-49280` · Maven `org.xwiki.contrib.changerequest:application-changerequest-default`: affected `>=0.1, <1.10`, fixed in `1.10` · CVSS 7.7 High · Not analysed yet · Published 5 Dec 2023 · Tags: Hard-coded credentials
- [Use of hardcoded certificate and private key](https://agentprime.io/advisories/CVE-2023-40464.md)
  `CVE-2023-40464` · CVE record: SierraWireless ALEOS · CVSS 8.1 High · Not analysed yet · Published 4 Dec 2023 · Tags: Hard-coded credentials
- [Use of Hard-Coded Credentials](https://agentprime.io/advisories/CVE-2023-40463.md)
  `CVE-2023-40463` · CVE record: SierraWireless ALEOS · CVSS 8.1 High · Not analysed yet · Published 4 Dec 2023 · Tags: Hard-coded credentials
- [Hard-coded password for access to power controller chip memory](https://agentprime.io/advisories/CVE-2023-28895.md)
  `CVE-2023-28895` · CVE record: JOYNEXT MIB3 Infotainment Unit · CVSS 3.5 Low · Not analysed yet · Published 1 Dec 2023 · Tags: Hard-coded credentials
- [Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials](https://agentprime.io/advisories/GHSA-qmhq-876f-cr65.md)
  `GHSA-qmhq-876f-cr65`, `CVE-2023-49653` · Maven `org.jenkins-ci.plugins:jira`: affected `<3.12`, fixed in `3.12` · CVSS 4.3 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Hard-coded credentials
- [Hardcoded Secrets](https://agentprime.io/advisories/CVE-2023-29064.md)
  `CVE-2023-29064` · CVE record: Becton, Dickinson and Company (BD) FACSChorus · CVSS 4.1 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: Hard-coded credentials
- [Password is send back to client](https://agentprime.io/advisories/CVE-2023-6254.md)
  `CVE-2023-6254` · CVE record: OTRS AG OTRS · CVSS 8.1 High · Not analysed yet · Published 27 Nov 2023 · Tags: Hard-coded credentials
- [PowerShell Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-36013.md)
  `CVE-2023-36013` · CVE record: Microsoft PowerShell 7.2 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 20 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Dell Mobility - E-Lab Navigator](https://agentprime.io/advisories/CVE-2023-44296.md)
  `CVE-2023-44296` · CVE record: Dell Mobility - E-Lab Navigator · CVSS 8.4 High · Not analysed yet · Published 16 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in First Co., Ltd. CFR-904E, CFR-908E, CFR-916E and others](https://agentprime.io/advisories/CVE-2023-47213.md)
  `CVE-2023-47213` · CVE record: First Co., Ltd. CFR-904E, CFR-908E, CFR-916E and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiAnalyzer and others](https://agentprime.io/advisories/CVE-2023-40719.md)
  `CVE-2023-40719` · CVE record: Fortinet FortiAnalyzer and 1 more · CVSS 4.1 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2023-33304.md)
  `CVE-2023-33304` · CVE record: Fortinet FortiClientWindows · CVSS 4.4 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Siemens RUGGEDCOM RM1224 LTE(4G) EU and others](https://agentprime.io/advisories/CVE-2023-44318.md)
  `CVE-2023-44318` · CVE record: Siemens RUGGEDCOM RM1224 LTE(4G) EU and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in AppsAnywhere Client](https://agentprime.io/advisories/CVE-2023-41137.md)
  `CVE-2023-41137` · CVE record: AppsAnywhere AppsAnywhere Client · CVSS 8.0 High · Not analysed yet · Published 9 Nov 2023 · Tags: Hard-coded credentials
- [TIBCO Spotfire Insufficiently Protected Credential vulnerability](https://agentprime.io/advisories/CVE-2023-26221.md)
  `CVE-2023-26221` · CVE record: TIBCO Software Inc. Spotfire Analyst and 2 more · CVSS 5.0 Medium · Not analysed yet · Published 8 Nov 2023 · Tags: Hard-coded credentials
- [An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.](https://agentprime.io/advisories/CVE-2023-29974.md)
  `CVE-2023-29974` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Nov 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Veeam One](https://agentprime.io/advisories/CVE-2023-38548.md)
  `CVE-2023-38548` · CVE record: Veeam One · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 7 Nov 2023 · Tags: Hard-coded credentials
- [Weintek EasyBuilder Pro Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-5777.md)
  `CVE-2023-5777` · CVE record: Weintek EasyBuilder Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2023 · Tags: Hard-coded credentials
- [Chunghwa Telecom NOKIA G-040W-Q - Weak Password Requirements](https://agentprime.io/advisories/CVE-2023-41353.md)
  `CVE-2023-41353` · CVE record: Chunghwa Telecom NOKIA G-040W-Q · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2023 · Tags: Hard-coded credentials
- [Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/GHSA-xr8c-mq5x-5f56.md)
  `GHSA-xr8c-mq5x-5f56`, `CVE-2023-31579` · Maven `top.tangyh.basic:lamp-core` and 1 more: affected `<3.8.1`, fixed in `3.8.1` · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2023 · Tags: Hard-coded credentials
- [xkeys seal encryption used fixed key for all encryption](https://agentprime.io/advisories/GHSA-mr45-rx8q-wcm9.md)
  `GHSA-mr45-rx8q-wcm9`, `BIT-nats-2023-46129`, `CVE-2023-46129`, `GO-2023-2163` · Go `github.com/nats-io/nats-server/v2` and 1 more: affected `>=2.10.0, <2.10.4`, fixed in `2.10.4` · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2023 · Tags: Hard-coded credentials, CWE-325
- [Jenkins Warnings Plugin exposures system-scoped credentials](https://agentprime.io/advisories/GHSA-66hv-fhcm-7xm7.md)
  `GHSA-66hv-fhcm-7xm7`, `CVE-2023-46651` · Maven `io.jenkins.plugins:warnings-ng`: affected `>=10.5.0, <10.5.1 || <10.4.1`, fixed in `10.5.1`, `10.4.1` · CVSS 4.3 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: Information disclosure, Hard-coded credentials
- [Sureness uses hardcoded key](https://agentprime.io/advisories/GHSA-3j2f-58rq-g6p7.md)
  `GHSA-3j2f-58rq-g6p7`, `CVE-2023-31581` · Maven `com.usthe.sureness:sureness-core`: affected `<1.0.8`, fixed in `1.0.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials
- [EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2023-42492.md)
  `CVE-2023-42492` · CVE record: EisBaer Scada v3.0.6433.1964 · CVSS 7.1 High · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Bosch Rexroth AG ctrlX HMI Web Panel - WR21 (WR2107) and others](https://agentprime.io/advisories/CVE-2023-46102.md)
  `CVE-2023-46102` · CVE record: Bosch Rexroth AG ctrlX HMI Web Panel - WR21 (WR2107) and 2 more · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Rexroth ctrlX HMI Web Panel - WR21 (WR2107) and others](https://agentprime.io/advisories/CVE-2023-41372.md)
  `CVE-2023-41372` · CVE record: Rexroth ctrlX HMI Web Panel - WR21 (WR2107) and 2 more · CVSS 7.8 High · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials
- [Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.](https://agentprime.io/advisories/CVE-2023-43905.md)
  `CVE-2023-43905` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2023 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDIzLTEwLTI1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy00MzkwNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI0LTAxLTIzVDIzOjEyOjQzLjE0MTAwMFoiLCJDVkUtMjAyNC0yMzQ1MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI0LTAxLTIzVDIzOjEyOjQzLjE0MTAwMFoiLCJDVkUtMjAyNC0yMzQ1MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.