# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Hard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations](https://agentprime.io/advisories/CVE-2025-48413.md)
  `CVE-2025-48413` · CVE record: eCharge Hardy Barth cPH2 / cPP2 charging stations · CVSS 7.7 High · Not analysed yet · Published 21 May 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in itech iLabClient](https://agentprime.io/advisories/CVE-2024-56429.md)
  `CVE-2024-56429` · CVE record: itech iLabClient · CVSS 7.7 High · Not analysed yet · Published 21 May 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Canon Inc. imageRUNNER Series and others](https://agentprime.io/advisories/CVE-2025-3079.md)
  `CVE-2025-3079` · CVE record: Canon Inc. imageRUNNER Series and 3 more · CVSS 6.3 Medium · Not analysed yet · Published 19 May 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Canon Inc. imageRUNNER ADVANCE Series and others](https://agentprime.io/advisories/CVE-2025-3078.md)
  `CVE-2025-3078` · CVE record: Canon Inc. imageRUNNER ADVANCE Series and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 19 May 2025 · Tags: Hard-coded credentials
- [Hardcoded Key Revealed in ConnectWise Password Encryption Utility](https://agentprime.io/advisories/CVE-2025-4876.md)
  `CVE-2025-4876` · CVE record: ConnectWise Risk Assessment · CVSS 6.0 Medium · Not analysed yet · Published 19 May 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Synology Active Backup for Microsoft 365](https://agentprime.io/advisories/CVE-2025-4679.md)
  `CVE-2025-4679` · CVE record: Synology Active Backup for Microsoft 365 · CVSS 6.5 Medium · Not analysed yet · Published 16 May 2025 · Tags: Hard-coded credentials
- [Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-27488.md)
  `CVE-2025-27488` · CVE record: Microsoft Windows 10 HLK version 20H2 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 13 May 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in ZKTeco ZKBio CVSecurity](https://agentprime.io/advisories/CVE-2025-45746.md)
  `CVE-2025-45746` · CVE record: ZKTeco ZKBio CVSecurity · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2025 · Tags: Hard-coded credentials
- [Improper Access Control](https://agentprime.io/advisories/CVE-2025-46742.md)
  `CVE-2025-46742` · CVE record: Schweitzer Engineering Laboratories SEL Blueframe OS · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2025 · Tags: Hard-coded credentials
- [SunGrow Logger1000 weak password](https://agentprime.io/advisories/CVE-2025-4534.md)
  `CVE-2025-4534` · CVE record: SunGrow Logger1000 · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2025 · Tags: Hard-coded credentials
- [IBM App Connect Enterprise Certified Container information disclosure](https://agentprime.io/advisories/CVE-2025-1993.md)
  `CVE-2025-1993` · CVE record: IBM App Connect Enterprise Certified Container · CVSS 5.1 Medium · Not analysed yet · Published 9 May 2025 · Tags: Hard-coded credentials
- [Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.](https://agentprime.io/advisories/CVE-2025-28200.md)
  `CVE-2025-28200` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in TeleMessage archiving backend](https://agentprime.io/advisories/CVE-2025-47730.md)
  `CVE-2025-47730` · CVE record: TeleMessage archiving backend · CVSS 4.8 Medium · Not analysed yet · Published 8 May 2025 · Tags: Hard-coded credentials
- [An issue was discovered in Znuny before 7.1.5.](https://agentprime.io/advisories/CVE-2025-26847.md)
  `CVE-2025-26847` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Cisco IOS XE Software](https://agentprime.io/advisories/CVE-2025-20188.md)
  `CVE-2025-20188` · CVE record: Cisco Cisco IOS XE Software · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 7 May 2025 · Tags: Hard-coded credentials
- [phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact](https://agentprime.io/advisories/CVE-2025-46820.md)
  `CVE-2025-46820` · CVE record: phpgt Dom · CVSS 7.1 High · Not analysed yet · Published 6 May 2025 · Tags: Information disclosure, Hard-coded credentials
- [Use of Hard-coded Credentials Optigo Networks ONS NC600](https://agentprime.io/advisories/CVE-2025-4041.md)
  `CVE-2025-4041` · CVE record: Optigo Networks ONS NC600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2025 · Tags: Hard-coded credentials
- [Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default](https://agentprime.io/advisories/CVE-2024-58134.md)
  `CVE-2024-58134` · CVE record: SRI Mojolicious · CVSS 8.1 High · Not analysed yet · Published 3 May 2025 · Tags: Hard-coded credentials, CWE-331
- [An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.](https://agentprime.io/advisories/CVE-2025-32889.md)
  `CVE-2025-32889` · CVE record · CVSS 7.3 High · Not analysed yet · Published 1 May 2025 · Tags: Hard-coded credentials
- [An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12.](https://agentprime.io/advisories/CVE-2025-32888.md)
  `CVE-2025-32888` · CVE record · CVSS 7.3 High · Not analysed yet · Published 1 May 2025 · Tags: Hard-coded credentials
- [Ribbon Communications - CWE-798: Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-23179.md)
  `CVE-2025-23179` · CVE record: Ribbon Communications Apollo 9608 · CVSS 5.5 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: Hard-coded credentials
- [Reuse of salt](https://agentprime.io/advisories/CVE-2025-32471.md)
  `CVE-2025-32471` · CVE record: SICK AG SICK FLX3-CPUC200 and 1 more · CVSS 3.7 Low · Not analysed yet · Published 28 Apr 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Quantum StorNext](https://agentprime.io/advisories/CVE-2025-46617.md)
  `CVE-2025-46617` · CVE record: Quantum StorNext · CVSS 7.2 High · Not analysed yet · Published 25 Apr 2025 · Tags: Hard-coded credentials
- [NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.](https://agentprime.io/advisories/CVE-2025-32985.md)
  `CVE-2025-32985` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Apr 2025 · Tags: Hard-coded credentials
- [Planet Technology Network Products Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-46274.md)
  `CVE-2025-46274` · CVE record: Planet Technology UNI-NMS-Lite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2025 · Tags: Hard-coded credentials
- [Planet Technology Network Products Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-46273.md)
  `CVE-2025-46273` · CVE record: Planet Technology UNI-NMS-Lite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in i-PRO Co., Ltd. i-PRO Configuration Tool](https://agentprime.io/advisories/CVE-2025-32730.md)
  `CVE-2025-32730` · CVE record: i-PRO Co., Ltd. i-PRO Configuration Tool · CVSS 6.8 Medium · Not analysed yet · Published 24 Apr 2025 · Tags: Hard-coded credentials
- [BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-2772.md)
  `CVE-2025-2772` · CVE record: BEC Technologies Multiple Routers · CVSS 5.3 Medium · Not analysed yet · Published 23 Apr 2025 · Tags: Hard-coded credentials
- [CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-2765.md)
  `CVE-2025-2765` · CVE record: CarlinKit CPC200-CCPA · CVSS 7.6 High · Not analysed yet · Published 23 Apr 2025 · Tags: Hard-coded credentials
- [Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel](https://agentprime.io/advisories/GHSA-j752-cjcj-w847.md)
  `GHSA-j752-cjcj-w847`, `CVE-2025-30206`, `GO-2025-3612` · Go `github.com/donknap/dpanel`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2025 · Tags: Hard-coded credentials, CWE-453, CWE-547
- [TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini.](https://agentprime.io/advisories/CVE-2025-28031.md)
  `CVE-2025-28031` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Hard-coded credentials
- [Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS](https://agentprime.io/advisories/GHSA-7m6v-q233-q9j9.md)
  `GHSA-7m6v-q233-q9j9`, `CVE-2025-32963`, `GO-2025-3637` · Go `github.com/minio/operator`: affected `<7.1.0`, fixed in `7.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: Hard-coded credentials
- [Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.](https://agentprime.io/advisories/CVE-2025-28230.md)
  `CVE-2025-28230` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Apr 2025 · Tags: Hard-coded credentials
- [A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plai…](https://agentprime.io/advisories/CVE-2025-28228.md)
  `CVE-2025-28228` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Apr 2025 · Tags: Hard-coded credentials
- [An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via UART component.](https://agentprime.io/advisories/CVE-2025-25984.md)
  `CVE-2025-25984` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 18 Apr 2025 · Tags: Hard-coded credentials
- [IBM Aspera Console weak password requirements](https://agentprime.io/advisories/CVE-2023-27272.md)
  `CVE-2023-27272` · CVE record: IBM Aspera Console · CVSS 3.1 Low · Not analysed yet · Published 14 Apr 2025 · Tags: Hard-coded credentials
- [Insecure password storage in SicommNet BASEC](https://agentprime.io/advisories/CVE-2025-22372.md)
  `CVE-2025-22372` · CVE record: SicommNet BASEC · CVSS 8.4 High · Not analysed yet · Published 14 Apr 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in OPEN, Inc. BizRobo!](https://agentprime.io/advisories/CVE-2025-31362.md)
  `CVE-2025-31362` · CVE record: OPEN, Inc. BizRobo! · CVSS 3.7 Low · Not analysed yet · Published 11 Apr 2025 · Tags: Hard-coded credentials
- [Magento does not properly protect credentials](https://agentprime.io/advisories/GHSA-2r94-wm5v-4prx.md)
  `GHSA-2r94-wm5v-4prx`, `CVE-2025-27192`, `PKSA-gkkr-yrmf-9dcm`, `PKSA-r73x-rxyx-dytq` · Packagist `magento/community-edition` and 1 more: affected `<2.4.4-p13 || >=2.4.5-p1, <2.4.5-p12 || >=2.4.6-p1, <2.4.6-p10 || >=2.4.7-beta1, <2.4.7-p5 || >=2.4.8-beta1, <2.4.8-beta2`, fixed in `2.4.4-p13`, `2.4.5-p12`, `2.4.6-p10`, `2.4.7-p5`, `2.4.8-beta2` · CVSS 2.7 Low · Not analysed yet · Published 8 Apr 2025 · Tags: Hard-coded credentials
- [Azure Local Cluster Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-26628.md)
  `CVE-2025-26628` · CVE record: Microsoft Azure Local Cluster · CVSS 7.3 High · Not analysed yet · Published 8 Apr 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Siemens SENTRON 7KT PAC1260 Data Manager](https://agentprime.io/advisories/CVE-2024-41794.md)
  `CVE-2024-41794` · CVE record: Siemens SENTRON 7KT PAC1260 Data Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: Hard-coded credentials
- [Use of default hardcoded credentials](https://agentprime.io/advisories/CVE-2025-3426.md)
  `CVE-2025-3426` · CVE record: Philips IntelliSpace Portal and 1 more · CVSS 7.2 High · Not analysed yet · Published 7 Apr 2025 · Tags: Hard-coded credentials
- [FastCMS JWT hard-coded key](https://agentprime.io/advisories/CVE-2025-3177.md)
  `CVE-2025-3177` · CVE record: FastCMS · CVSS 2.3 Low · Not analysed yet · Published 3 Apr 2025 · Tags: Hard-coded credentials, CWE-320
- [Hard-coded cryptographic key in Gladinet CentreStack](https://agentprime.io/advisories/CVE-2025-30406.md)
  `CVE-2025-30406` · CVE record: Gladinet CentreStack · CVSS 9.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.95 · Not analysed yet · Published 3 Apr 2025 · Tags: Hard-coded credentials
- [Hard-coded password for object store of KNIME Business Hub](https://agentprime.io/advisories/CVE-2025-2402.md)
  `CVE-2025-2402` · CVE record: KNIME KNIME Business Hub · CVSS 8.8 High · Not analysed yet · Published 31 Mar 2025 · Tags: Hard-coded credentials
- [Weak password requirements in Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001)](https://agentprime.io/advisories/CVE-2025-25211.md)
  `CVE-2025-25211` · CVE record: Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in VyOS](https://agentprime.io/advisories/CVE-2025-30095.md)
  `CVE-2025-30095` · CVE record: VyOS VyOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2025 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials vulnerability in MeetMe products](https://agentprime.io/advisories/CVE-2025-2908.md)
  `CVE-2025-2908` · CVE record: Fermax MeetMe · CVSS 8.5 High · Not analysed yet · Published 28 Mar 2025 · Tags: Hard-coded credentials
- [An issue was discovered on the Audi Universal Traffic Recorder 2.88.](https://agentprime.io/advisories/CVE-2025-30118.md)
  `CVE-2025-30118` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2025 · Tags: Hard-coded credentials
- [BUG-000174336](https://agentprime.io/advisories/CVE-2025-2538.md)
  `CVE-2025-2538` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials
- [Audi UTR Dashcam Video Stream hard-coded credentials](https://agentprime.io/advisories/CVE-2025-2556.md)
  `CVE-2025-2556` · CVE record: Audi UTR Dashcam · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials
- [Audi Universal Traffic Recorder App FTP Credentials hard-coded password](https://agentprime.io/advisories/CVE-2025-2555.md)
  `CVE-2025-2555` · CVE record: Audi Universal Traffic Recorder App · CVSS 2.1 Low · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials, CWE-255
- [Authentication Bypass in Sechard Information Technologies' SecHard](https://agentprime.io/advisories/CVE-2025-2311.md)
  `CVE-2025-2311` · CVE record: Sechard Information Technologies SecHard · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-648
- [In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be suscep...](https://agentprime.io/advisories/GHSA-4rj2-9gcx-5qhx.md)
  `GHSA-4rj2-9gcx-5qhx`, `BIT-mlflow-2025-1474`, `CVE-2025-1474`, `PYSEC-2025-17` · PyPI `mlflow`: affected `<2.19.0`, fixed in `2.19.0` · CVSS 3.8 Low · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials
- [Spring Security Does Not Enforce Password Length](https://agentprime.io/advisories/GHSA-mg83-c7gq-rv5c.md)
  `GHSA-mg83-c7gq-rv5c`, `CVE-2025-22228` · Maven `org.springframework.security:spring-security-crypto`: affected `>=6.3.0, <6.3.8 || >=6.4.0, <6.4.4 || >=6.2.0, <6.2.10 || >=6.1.0, <6.1.14 || >=6.0.0, <6.0.16 || >=5.8.0, <5.8.18 || <5.7.16`, fixed in `6.3.8`, `6.4.4`, `6.2.10`, `6.1.14`, `6.0.16`, `5.8.18`, `5.7.16` · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: Authentication bypass, Hard-coded credentials
- [Jenkins Zoho QEngine Plugin Displays Unmasked API Keys](https://agentprime.io/advisories/GHSA-2x3g-rr4w-4qrp.md)
  `GHSA-2x3g-rr4w-4qrp`, `CVE-2025-30197` · Maven `io.jenkins.plugins:zohoqengine`: affected `<1.0.31.v4a_b_1db_6d6a_f2`, fixed in `1.0.31.v4a_b_1db_6d6a_f2` · CVSS 3.1 Low · Not analysed yet · Published 19 Mar 2025 · Tags: Hard-coded credentials, CWE-549
- [Hard-coded cryptographic key in MNX SmartOS](https://agentprime.io/advisories/CVE-2025-30234.md)
  `CVE-2025-30234` · CVE record: MNX SmartOS · CVSS 8.3 High · Not analysed yet · Published 19 Mar 2025 · Tags: Hard-coded credentials
- [An issue was discovered in the G-Net GNET APK 2.6.2.](https://agentprime.io/advisories/CVE-2025-30137.md)
  `CVE-2025-30137` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [An issue was discovered on ROADCAM X3 devices.](https://agentprime.io/advisories/CVE-2025-30123.md)
  `CVE-2025-30123` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [An issue was discovered on ROADCAM X3 devices.](https://agentprime.io/advisories/CVE-2025-30122.md)
  `CVE-2025-30122` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI1LTAzLTE4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS0zMDEyMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI1LTA1LTIxVDExOjQwOjUwLjQyNDAwMFoiLCJDVkUtMjAyNS00ODQxNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI1LTA1LTIxVDExOjQwOjUwLjQyNDAwMFoiLCJDVkUtMjAyNS00ODQxNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.