# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Pan-Tilt-Zoom cameras default administrative credentials for web interface](https://agentprime.io/advisories/CVE-2025-35452.md) `CVE-2025-35452` · CVE record: PTZOptics PT12X-SE-xx-G3 and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2025 · Tags: Hard-coded credentials, CWE-1392 - [ECOVACS Vacuum and Base Station Hard-Coded WPA2-PSK](https://agentprime.io/advisories/CVE-2025-30198.md) `CVE-2025-30198` · CVE record: ECOVACS DEEBOT X1 Series and 3 more · CVSS 2.3 Low · Not analysed yet · Published 5 Sept 2025 · Tags: Hard-coded credentials - [Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled](https://agentprime.io/advisories/CVE-2025-35451.md) `CVE-2025-35451` · CVE record: PTZOptics PT12X-SE-xx-G3 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2025 · Tags: Hard-coded credentials - [ECOVACS Vacuum and Base Station Hard-Coded AES Encryption](https://agentprime.io/advisories/CVE-2025-30200.md) `CVE-2025-30200` · CVE record: ECOVACS DEEBOT X1 Series and 3 more · CVSS 2.3 Low · Not analysed yet · Published 5 Sept 2025 · Tags: Hard-coded credentials - [api: Shared OAuth Signing Key Between Different Instances](https://agentprime.io/advisories/CVE-2025-55739.md) `CVE-2025-55739` · CVE record: FreePBX api · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Hard-coded credentials - [Local Deep Research's API keys are stored in plain text](https://agentprime.io/advisories/CVE-2025-57806.md) `CVE-2025-57806` · CVE record: LearningCircuit local-deep-research · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Information disclosure, Hard-coded credentials - [Use of Hard-coded Credentials in SunPower PVS6](https://agentprime.io/advisories/CVE-2025-9696.md) `CVE-2025-9696` · CVE record: SunPower PVS6 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2025 · Tags: Hard-coded credentials - [Predictable root linux password generation](https://agentprime.io/advisories/CVE-2025-52549.md) `CVE-2025-52549` · CVE record: Copeland LP E3 Supervisory Control · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2025 · Tags: Hard-coded credentials - [Privilege escalation in the application services](https://agentprime.io/advisories/CVE-2025-52545.md) `CVE-2025-52545` · CVE record: Copeland LP E3 Supervisory Control · CVSS 7.7 High · Not analysed yet · Published 2 Sept 2025 · Tags: Hard-coded credentials - [Consistent predictable generation of the password for the default admin user "ONEDAY" to the application services](https://agentprime.io/advisories/CVE-2025-6519.md) `CVE-2025-6519` · CVE record: Copeland LP E3 Supervisory Control · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2025 · Tags: Hard-coded credentials - [Tenda F1202 Administrative shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9806.md) `CVE-2025-9806` · CVE record: Tenda F1202 · CVSS 1.8 Low · Not analysed yet · Published 2 Sept 2025 · Tags: Hard-coded credentials - [Tenda W12 Administrative shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9778.md) `CVE-2025-9778` · CVE record: Tenda W12 · CVSS 1.8 Low · Not analysed yet · Published 1 Sept 2025 · Tags: Hard-coded credentials - [Tenda AC9 Administrative shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9731.md) `CVE-2025-9731` · CVE record: Tenda AC9 · CVSS 2.0 Low · Not analysed yet · Published 31 Aug 2025 · Tags: Hard-coded credentials - [Cudy LT500E Web shadow hard-coded password](https://agentprime.io/advisories/CVE-2025-9725.md) `CVE-2025-9725` · CVE record: Cudy LT500E · CVSS 2.0 Low · Not analysed yet · Published 31 Aug 2025 · Tags: Hard-coded credentials, CWE-255 - [Changing｜Clinic Image System - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-8857.md) `CVE-2025-8857` · CVE record: Changing Clinic Image System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2025 · Tags: Hard-coded credentials - [coze-studio aes.go hard-coded key](https://agentprime.io/advisories/CVE-2025-9604.md) `CVE-2025-9604` · CVE record: coze-studio · CVSS 6.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Hard-coded credentials, CWE-320 - [An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys.](https://agentprime.io/advisories/CVE-2025-56577.md) `CVE-2025-56577` · CVE record · CVSS 8.4 High · Not analysed yet · Published 29 Aug 2025 · Tags: Hard-coded credentials - [NeuVector process with sensitive arguments lead to leakage](https://agentprime.io/advisories/GHSA-w54x-xfxg-4gxq.md) `GHSA-w54x-xfxg-4gxq`, `CVE-2025-54467`, `GO-2025-3919` · Go `github.com/neuvector/neuvector`: affected `<0.0.0-20250902144615-f9ddbdf42031`, fixed in `0.0.0-20250902144615-f9ddbdf42031` · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Hard-coded credentials, CWE-549 - [Hard-coded password in DOS Co., Ltd. SS1](https://agentprime.io/advisories/CVE-2025-58081.md) `CVE-2025-58081` · CVE record: DOS Co., Ltd. SS1 · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2025 · Tags: Hard-coded credentials - [macrozheng mall Registration weak password](https://agentprime.io/advisories/CVE-2025-9514.md) `CVE-2025-9514` · CVE record: macrozheng mall · CVSS 6.3 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Hard-coded credentials - [egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass](https://agentprime.io/advisories/CVE-2025-41702.md) `CVE-2025-41702` · CVE record: Welotec EG400Mk2-D11001-000101 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2025 · Tags: Hard-coded credentials - [Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User acc…](https://agentprime.io/advisories/CVE-2025-25737.md) `CVE-2025-25737` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Hard-coded credentials - [Securden Unified PAM Shared SSH Key and Cloud Infrastructure](https://agentprime.io/advisories/CVE-2025-6737.md) `CVE-2025-6737` · CVE record: Securden Unified PAM · CVSS 7.2 High · Not analysed yet · Published 25 Aug 2025 · Tags: Hard-coded credentials - [FNKvision Y215 CCTV Camera Firmware passwd hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9380.md) `CVE-2025-9380` · CVE record: FNKvision Y215 CCTV Camera · CVSS 8.5 High · Not analysed yet · Published 24 Aug 2025 · Tags: Hard-coded credentials - [Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector.](https://agentprime.io/advisories/CVE-2025-55619.md) `CVE-2025-55619` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2025 · Tags: Hard-coded credentials - [An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll](https://agentprime.io/advisories/CVE-2025-52095.md) `CVE-2025-52095` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2025 · Tags: Hard-coded credentials - [hippo4j Includes Hard Coded Secret Key in JWT Creation](https://agentprime.io/advisories/GHSA-48cg-9c55-j2q7.md) `GHSA-48cg-9c55-j2q7`, `CVE-2025-51606` · Maven `cn.hippo4j:hippo4j-core`: affected `>=1.0.0, <=1.5.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2025 · Tags: Hard-coded credentials - [yeqifu carRental Druid login.html hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9310.md) `CVE-2025-9310` · CVE record: yeqifu carRental · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Hard-coded credentials - [Tenda AC10 MD5 Hash shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9309.md) `CVE-2025-9309` · CVE record: Tenda AC10 · CVSS 2.0 Low · Not analysed yet · Published 21 Aug 2025 · Tags: Hard-coded credentials - [Unauthorized API Access Risk](https://agentprime.io/advisories/CVE-2025-57788.md) `CVE-2025-57788` · CVE record: Commvault CommCell · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Hard-coded credentials - [GenX_FX authentication bypass in JWT validation](https://agentprime.io/advisories/CVE-2025-55306.md) `CVE-2025-55306` · CVE record: Mouy-leng GenX_FX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Hard-coded credentials - [VaulTLS has a password-based login exploit in additional user accounts](https://agentprime.io/advisories/CVE-2025-55299.md) `CVE-2025-55299` · CVE record: 7ritn VaulTLS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2025 · Tags: Hard-coded credentials - [IBM Concert Software information disclosure](https://agentprime.io/advisories/CVE-2025-33100.md) `CVE-2025-33100` · CVE record: IBM Concert Software · CVSS 6.2 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Hard-coded credentials - [TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.](https://agentprime.io/advisories/CVE-2025-55584.md) `CVE-2025-55584` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Hard-coded credentials - [VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override](https://agentprime.io/advisories/CVE-2025-7342.md) `CVE-2025-7342` · CVE record: Kubernetes Image Builder · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2025 · Tags: Hard-coded credentials - [Tenda AC20 shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-9091.md) `CVE-2025-9091` · CVE record: Tenda AC20 · CVSS 2.0 Low · Not analysed yet · Published 17 Aug 2025 · Tags: Hard-coded credentials - [linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials](https://agentprime.io/advisories/CVE-2025-8974.md) `CVE-2025-8974` · CVE record: linlinjava litemall · CVSS 6.3 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Hard-coded credentials - [Hard-coded Private Key Vulnerability in ZKTeco WL20](https://agentprime.io/advisories/CVE-2025-55279.md) `CVE-2025-55279` · CVE record: ZKTeco Co WL20 Biometric Attendance System · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Hard-coded credentials - [Hard-coded Credentials Vulnerability in ZKTeco WL20](https://agentprime.io/advisories/CVE-2025-54465.md) `CVE-2025-54465` · CVE record: ZKTeco Co WL20 Biometric Attendance System · CVSS 6.8 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Hard-coded credentials - [Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default.](https://agentprime.io/advisories/CVE-2025-43982.md) `CVE-2025-43982` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Hard-coded credentials - [Exposed SFTP server](https://agentprime.io/advisories/CVE-2025-3831.md) `CVE-2025-3831` · CVE record: checkpoint Check Point Harmony SASE · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2025 · Tags: Information disclosure, Hard-coded credentials - [Insufficiently protected credentials in Siemens SIMATIC RTLS Locating Manager](https://agentprime.io/advisories/CVE-2025-40751.md) `CVE-2025-40751` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 4.8 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Hard-coded credentials - [SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability](https://agentprime.io/advisories/CVE-2025-26398.md) `CVE-2025-26398` · CVE record: SolarWinds Database Performance Analyzer · CVSS 5.6 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Hard-coded credentials - [TRENDnet TN-200 Lighttpd hard-coded key](https://agentprime.io/advisories/CVE-2025-8759.md) `CVE-2025-8759` · CVE record: TRENDnet TN-200 · CVSS 6.3 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Hard-coded credentials, CWE-320 - [Belkin F9K1009/F9K1010 Web Interface hard-coded credentials](https://agentprime.io/advisories/CVE-2025-8730.md) `CVE-2025-8730` · CVE record: Belkin F9K1009 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Hard-coded credentials - [Weak credentials in SEIKO EPSON Multiple EPSON product and others](https://agentprime.io/advisories/CVE-2025-35970.md) `CVE-2025-35970` · CVE record: SEIKO EPSON Multiple EPSON product and 1 more · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2025 · Tags: Hard-coded credentials - [Himmelblau's Kerberos credential cache collection is world readable](https://agentprime.io/advisories/CVE-2025-54882.md) `CVE-2025-54882` · CVE record: himmelblau-idm himmelblau · CVSS 7.1 High · Not analysed yet · Published 7 Aug 2025 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in Tigo Energy Cloud Connect Advanced](https://agentprime.io/advisories/CVE-2025-7768.md) `CVE-2025-7768` · CVE record: Tigo Energy Cloud Connect Advanced · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2025 · Tags: Hard-coded credentials - [An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices.](https://agentprime.io/advisories/CVE-2025-30127.md) `CVE-2025-30127` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2025 · Tags: Information disclosure, Broken access control, Hard-coded credentials - [onion-site-template tor Secrets Baked Into Image](https://agentprime.io/advisories/CVE-2025-54872.md) `CVE-2025-54872` · CVE record: Vessel9817 onion-site-template · CVSS 8.7 High · Not analysed yet · Published 5 Aug 2025 · Tags: Hard-coded credentials - [Jans CLI stores plaintext passwords in the local cli_cmd.log file](https://agentprime.io/advisories/CVE-2025-54876.md) `CVE-2025-54876` · CVE record: JanssenProject jans · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Hard-coded credentials - [Draeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-2810.md) `CVE-2025-2810` · CVE record: Draeger Draeger ICMHelper · CVSS 5.5 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Hard-coded credentials - [atjiu pybbs UserAdminController.java update weak password](https://agentprime.io/advisories/CVE-2025-8549.md) `CVE-2025-8549` · CVE record: atjiu pybbs · CVSS 6.3 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell ECS and others](https://agentprime.io/advisories/CVE-2025-26476.md) `CVE-2025-26476` · CVE record: Dell ECS and 1 more · CVSS 8.4 High · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Dell Enterprise SONiC OS](https://agentprime.io/advisories/CVE-2025-38741.md) `CVE-2025-38741` · CVE record: Dell Enterprise SONiC OS · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Dell Digital Delivery](https://agentprime.io/advisories/CVE-2025-38739.md) `CVE-2025-38739` · CVE record: Dell Dell Digital Delivery · CVSS 7.2 High · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials - [Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.](https://agentprime.io/advisories/CVE-2025-51536.md) `CVE-2025-51536` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials, CWE-1392 - [Hard-coded cryptographic key in RUCKUS Network Director](https://agentprime.io/advisories/CVE-2025-44963.md) `CVE-2025-44963` · CVE record: RUCKUS Network Director · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials - [Hard-coded password in RUCKUS Network Director](https://agentprime.io/advisories/CVE-2025-44955.md) `CVE-2025-44955` · CVE record: RUCKUS Network Director · CVSS 8.8 High · Not analysed yet · Published 4 Aug 2025 · Tags: Hard-coded credentials - [Certain Draytek products are affected by Insecure Configuration.](https://agentprime.io/advisories/CVE-2025-44643.md) `CVE-2025-44643` · CVE record · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2025 · Tags: Broken access control, Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .