# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Hard-coded cryptographic key in 2N Access Commander](https://agentprime.io/advisories/CVE-2024-47256.md)
  `CVE-2024-47256` · CVE record: 2N 2N Access Commander · CVSS 6.0 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: Hard-coded credentials
- [Credentials Disclosure - keys](https://agentprime.io/advisories/CVE-2024-51547.md)
  `CVE-2024-51547` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2025 · Tags: Hard-coded credentials
- [An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information via the Weak default WiFi password generat…](https://agentprime.io/advisories/CVE-2025-22936.md)
  `CVE-2025-22936` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: Hard-coded credentials
- [Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulne…](https://agentprime.io/advisories/CVE-2024-36556.md)
  `CVE-2024-36556` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2025 · Tags: Hard-coded credentials
- [Four-Faith F3x36 Hidden Debug Credentials](https://agentprime.io/advisories/CVE-2024-9643.md)
  `CVE-2024-9643` · CVE record: Four-Faith F3x36 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2025 · Tags: Hard-coded credentials, CWE-489
- [SMB/FTP Address Book Scan Pass-back attack](https://agentprime.io/advisories/CVE-2024-12511.md)
  `CVE-2024-12511` · CVE record: Xerox Versalink B400 and 4 more · CVSS 7.6 High · Not analysed yet · Published 3 Feb 2025 · Tags: Authentication bypass, Hard-coded credentials
- [Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addali…](https://agentprime.io/advisories/CVE-2024-53357.md)
  `CVE-2024-53357` · CVE record · CVSS 7.5 High · Not analysed yet · Published 31 Jan 2025 · Tags: Hard-coded credentials
- [Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation.](https://agentprime.io/advisories/CVE-2024-53356.md)
  `CVE-2024-53356` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jan 2025 · Tags: Hard-coded credentials
- [Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability](https://agentprime.io/advisories/CVE-2025-0477.md)
  `CVE-2025-0477` · CVE record: Rockwell Automation FactoryTalk® AssetCentre · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2025 · Tags: Hard-coded credentials
- [Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability](https://agentprime.io/advisories/CVE-2025-0497.md)
  `CVE-2025-0497` · CVE record: Rockwell Automation FactoryTalk® AssetCentre · CVSS 7.3 High · Not analysed yet · Published 30 Jan 2025 · Tags: Hard-coded credentials
- [Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability](https://agentprime.io/advisories/CVE-2025-0498.md)
  `CVE-2025-0498` · CVE record: Rockwell Automation FactoryTalk® AssetCentre · CVSS 7.0 High · Not analysed yet · Published 30 Jan 2025 · Tags: Hard-coded credentials
- [IBM Aspera Faspex information disclosure](https://agentprime.io/advisories/CVE-2023-35907.md)
  `CVE-2023-35907` · CVE record: IBM Aspera Faspex · CVSS 5.9 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Hard-coded credentials
- [IBM Aspera Faspex information disclosure](https://agentprime.io/advisories/CVE-2023-37398.md)
  `CVE-2023-37398` · CVE record: IBM Aspera Faspex · CVSS 5.9 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Hard-coded credentials
- [Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password an…](https://agentprime.io/advisories/CVE-2024-57395.md)
  `CVE-2024-57395` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jan 2025 · Tags: Hard-coded credentials
- [The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover ho…](https://agentprime.io/advisories/CVE-2024-23733.md)
  `CVE-2024-23733` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2025 · Tags: Hard-coded credentials
- [SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter.](https://agentprime.io/advisories/CVE-2024-50692.md)
  `CVE-2024-50692` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 24 Jan 2025 · Tags: Hard-coded credentials
- [SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates.](https://agentprime.io/advisories/CVE-2024-50690.md)
  `CVE-2024-50690` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 Jan 2025 · Tags: Hard-coded credentials
- [Flawed token generation implementation & Hard-coded key implementation](https://agentprime.io/advisories/CVE-2024-55927.md)
  `CVE-2024-55927` · CVE record: Xerox Xerox Workplace Suite · CVSS 7.6 High · Not analysed yet · Published 23 Jan 2025 · Tags: Hard-coded credentials
- [ECOVACS lawnmowers and vacuums static BLE GATT encryption key](https://agentprime.io/advisories/CVE-2024-12078.md)
  `CVE-2024-12078` · CVE record: ECOVACS Unspecified robots · CVSS 5.3 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Hard-coded credentials
- [ECOVACS lawnmowers and vacuums deterministic root password](https://agentprime.io/advisories/CVE-2024-11147.md)
  `CVE-2024-11147` · CVE record: ECOVACS Unspecified robots · CVSS 7.0 High · Not analysed yet · Published 23 Jan 2025 · Tags: Hard-coded credentials
- [ECOVACS lawnmowers and vacuums deterministic firmware encryption key](https://agentprime.io/advisories/CVE-2024-52331.md)
  `CVE-2024-52331` · CVE record: ECOVACS Unspecified robots · CVSS 7.7 High · Not analysed yet · Published 23 Jan 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-494
- [Unsafe stored password recovery](https://agentprime.io/advisories/CVE-2025-0619.md)
  `CVE-2025-0619` · CVE record: M-Files Corporation M-Files Server · CVSS 4.6 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Hard-coded credentials
- [GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed.](https://agentprime.io/advisories/CVE-2024-42012.md)
  `CVE-2024-42012` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 22 Jan 2025 · Tags: Hard-coded credentials
- [Ossur Mobile Logic Application Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2024-45832.md)
  `CVE-2024-45832` · CVE record: Ossur Mobile Logic Application · CVSS 2.0 Low · Not analysed yet · Published 17 Jan 2025 · Tags: Hard-coded credentials
- [Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop](https://agentprime.io/advisories/CVE-2025-23040.md)
  `CVE-2025-23040` · CVE record: desktop desktop · CVSS 6.6 Medium · Not analysed yet · Published 15 Jan 2025 · Tags: Hard-coded credentials
- [HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.](https://agentprime.io/advisories/CVE-2024-48126.md)
  `CVE-2024-48126` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2024-50564.md)
  `CVE-2024-50564` · CVE record: Fortinet FortiClientWindows · CVSS 3.2 Low · Not analysed yet · Published 14 Jan 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Fortinet FortiSwitch](https://agentprime.io/advisories/CVE-2023-37936.md)
  `CVE-2023-37936` · CVE record: Fortinet FortiSwitch · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2025 · Tags: Hard-coded credentials
- [In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH.](https://agentprime.io/advisories/CVE-2024-57811.md)
  `CVE-2024-57811` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Venki Supravizio BPM](https://agentprime.io/advisories/CVE-2024-46480.md)
  `CVE-2024-46480` · CVE record: Venki Supravizio BPM · CVSS 8.4 High · Not analysed yet · Published 13 Jan 2025 · Tags: Hard-coded credentials
- [HCL MyXalytics is affected by an improper password policy implementation vulnerability](https://agentprime.io/advisories/CVE-2024-42173.md)
  `CVE-2024-42173` · CVE record: HCL Software DRYiCE MyXalytics · CVSS 4.8 Medium · Not analysed yet · Published 11 Jan 2025 · Tags: Hard-coded credentials
- [Plaintext default credentials in firmware](https://agentprime.io/advisories/CVE-2024-43659.md)
  `CVE-2024-43659` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 8.3 High · Not analysed yet · Published 9 Jan 2025 · Tags: Hard-coded credentials, CWE-256, CWE-1393
- [Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.](https://agentprime.io/advisories/CVE-2024-46505.md)
  `CVE-2024-46505` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2025 · Tags: Broken access control, Information disclosure, Weak cryptography or TLS, Hard-coded credentials
- [IBM Cognos Controller information disclosure](https://agentprime.io/advisories/CVE-2024-28778.md)
  `CVE-2024-28778` · CVE record: IBM Controller and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Jan 2025 · Tags: Hard-coded credentials
- [An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0.](https://agentprime.io/advisories/CVE-2025-22390.md)
  `CVE-2025-22390` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Jan 2025 · Tags: Hard-coded credentials
- [Weak credentials in CTFd](https://agentprime.io/advisories/CVE-2024-11717.md)
  `CVE-2024-11717` · CVE record: CTFd CTFd · CVSS 6.3 Medium · Not analysed yet · Published 2 Jan 2025 · Tags: Hard-coded credentials, CWE-837
- [Insufficiently protected credentials in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2024-56354.md)
  `CVE-2024-56354` · CVE record: JetBrains TeamCity · CVSS 5.5 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Hard-coded credentials
- [Improper authentication in HUAWEI Mate 20 Pro](https://agentprime.io/advisories/CVE-2020-9250.md)
  `CVE-2020-9250` · CVE record: Huawei HUAWEI Mate 20 Pro · CVSS 3.3 Low · Not analysed yet · Published 20 Dec 2024 · Tags: Authentication bypass, Hard-coded credentials
- [Weak credentials in Sophos Firewall](https://agentprime.io/advisories/CVE-2024-12728.md)
  `CVE-2024-12728` · CVE record: Sophos Sophos Firewall · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2024 · Tags: Hard-coded credentials
- [QTS, QuTS hero, QuTScloud](https://agentprime.io/advisories/CVE-2022-27600.md)
  `CVE-2022-27600` · CVE record: QNAP Systems Inc. QTS and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Denial of service, Hard-coded credentials
- [IBM Robotic Process Automation information disclosure](https://agentprime.io/advisories/CVE-2022-33954.md)
  `CVE-2022-33954` · CVE record: IBM Robotic Process Automation · CVSS 4.6 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: Hard-coded credentials
- [Hardcoded Password in Wapro ERP Desktop](https://agentprime.io/advisories/CVE-2024-4996.md)
  `CVE-2024-4996` · CVE record: Asseco Business Solutions S.A. Wapro ERP Desktop · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2024 · Tags: Hard-coded credentials
- [ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.](https://agentprime.io/advisories/CVE-2024-55557.md)
  `CVE-2024-55557` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in Dell RecoverPoint for Virtual Machines](https://agentprime.io/advisories/CVE-2024-48007.md)
  `CVE-2024-48007` · CVE record: Dell RecoverPoint for Virtual Machines · CVSS 5.3 Medium · Not analysed yet · Published 13 Dec 2024 · Tags: Hard-coded credentials
- [Hardcoded credentials](https://agentprime.io/advisories/CVE-2024-28146.md)
  `CVE-2024-28146` · CVE record: Image Access GmbH Scan2Net · CVSS 8.4 High · Not analysed yet · Published 12 Dec 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Apple macOS](https://agentprime.io/advisories/CVE-2024-54471.md)
  `CVE-2024-54471` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Siemens CPCI85 Central Processing/Communication](https://agentprime.io/advisories/CVE-2024-53832.md)
  `CVE-2024-53832` · CVE record: Siemens CPCI85 Central Processing/Communication · CVSS 5.1 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: Hard-coded credentials
- [TP-Link TL-WR845N(UN)\_V4_201214, TL-WR845N(UN)\_V4_200909 and TL-WR845N(UN)\_V4_190219 were discovered to contain weak default credentials for the Administrator account.](https://agentprime.io/advisories/CVE-2024-50699.md)
  `CVE-2024-50699` · CVE record · CVSS 8.0 High · Not analysed yet · Published 10 Dec 2024 · Tags: Hard-coded credentials
- [TP-Link TL-WR845N(UN)\_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-the-middle attack.](https://agentprime.io/advisories/CVE-2024-46341.md)
  `CVE-2024-46341` · CVE record · CVSS 8.0 High · Not analysed yet · Published 10 Dec 2024 · Tags: Hard-coded credentials
- [Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.](https://agentprime.io/advisories/CVE-2024-40583.md)
  `CVE-2024-40583` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2024 · Tags: Hard-coded credentials
- [Ruijie Reyee OS Use of Weak Credentials](https://agentprime.io/advisories/CVE-2024-45722.md)
  `CVE-2024-45722` · CVE record: Ruijie Reyee OS · CVSS 8.7 High · Not analysed yet · Published 6 Dec 2024 · Tags: Hard-coded credentials
- [Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-54750.md)
  `CVE-2024-54750` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2024 · Tags: Hard-coded credentials
- [Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-54749.md)
  `CVE-2024-54749` · CVE record · CVSS 7.5 High · Not analysed yet · Published 6 Dec 2024 · Tags: Hard-coded credentials
- [Hard-coded credentials in SonicWall SMA100](https://agentprime.io/advisories/CVE-2024-45319.md)
  `CVE-2024-45319` · CVE record: SonicWall SMA100 · CVSS 6.3 Medium · Not analysed yet · Published 5 Dec 2024 · Tags: Hard-coded credentials
- [Username Enumeration](https://agentprime.io/advisories/CVE-2024-51545.md)
  `CVE-2024-51545` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2024 · Tags: Hard-coded credentials
- [Weak Password Rules/Strength](https://agentprime.io/advisories/CVE-2024-48845.md)
  `CVE-2024-48845` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2024 · Tags: Hard-coded credentials
- [STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface.](https://agentprime.io/advisories/CVE-2023-48010.md)
  `CVE-2023-48010` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2024 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Veeam Backup & Replication](https://agentprime.io/advisories/CVE-2024-42457.md)
  `CVE-2024-42457` · CVE record: Veeam Backup & Replication · CVSS 7.7 High · Not analysed yet · Published 4 Dec 2024 · Tags: Hard-coded credentials
- [A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges.](https://agentprime.io/advisories/CVE-2024-53614.md)
  `CVE-2024-53614` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Hard-coded credentials
- [IBM Cognos Controller hard coded credentials](https://agentprime.io/advisories/CVE-2024-41777.md)
  `CVE-2024-41777` · CVE record: IBM Cognos Controller · CVSS 7.5 High · Not analysed yet · Published 3 Dec 2024 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI0LTEyLTAzVDE3OjEwOjA2LjQwMzAwMFoiLCJDVkUtMjAyNC00MTc3NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI1LTAyLTA2VDIwOjMxOjA3LjkwODAwMFoiLCJDVkUtMjAyNS0xMDgxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI1LTAyLTA2VDIwOjMxOjA3LjkwODAwMFoiLCJDVkUtMjAyNS0xMDgxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.