# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.](https://agentprime.io/advisories/CVE-2025-30115.md)
  `CVE-2025-30115` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820.](https://agentprime.io/advisories/CVE-2025-30113.md)
  `CVE-2025-30113` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092.](https://agentprime.io/advisories/CVE-2025-30109.md)
  `CVE-2025-30109` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user.](https://agentprime.io/advisories/CVE-2025-30106.md)
  `CVE-2025-30106` · CVE record · CVSS 8.8 High · Not analysed yet · Published 18 Mar 2025 · Tags: Hard-coded credentials
- [Hard-coded password in Dell SmartFabric OS10 Software](https://agentprime.io/advisories/CVE-2024-48831.md)
  `CVE-2024-48831` · CVE record: Dell SmartFabric OS10 Software · CVSS 8.4 High · Not analysed yet · Published 17 Mar 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiSIEM](https://agentprime.io/advisories/CVE-2019-17659.md)
  `CVE-2019-17659` · CVE record: Fortinet FortiSIEM · CVSS 3.6 Low · Not analysed yet · Published 17 Mar 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Fortinet FortiSandbox](https://agentprime.io/advisories/CVE-2024-54027.md)
  `CVE-2024-54027` · CVE record: Fortinet FortiSandbox · CVSS 7.8 High · Not analysed yet · Published 17 Mar 2025 · Tags: Hard-coded credentials
- [Account Takeover](https://agentprime.io/advisories/CVE-2025-1724.md)
  `CVE-2025-1724` · CVE record: Zohocorp Analytics Plus · CVSS 7.4 High · Not analysed yet · Published 17 Mar 2025 · Tags: Hard-coded credentials
- [An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.](https://agentprime.io/advisories/CVE-2025-25650.md)
  `CVE-2025-25650` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Mar 2025 · Tags: Hard-coded credentials
- [IROAD Dash Cam X5/Dash Cam X6 Device Pairing hard-coded credentials](https://agentprime.io/advisories/CVE-2025-2343.md)
  `CVE-2025-2343` · CVE record: IROAD Dash Cam X5 and 1 more · CVSS 7.7 High · Not analysed yet · Published 16 Mar 2025 · Tags: Hard-coded credentials
- [IROAD X5 Mobile App API Endpoint hard-coded credentials](https://agentprime.io/advisories/CVE-2025-2342.md)
  `CVE-2025-2342` · CVE record: IROAD X5 Mobile App · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2025 · Tags: Hard-coded credentials
- [274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials](https://agentprime.io/advisories/CVE-2025-2322.md)
  `CVE-2025-2322` · CVE record: 274056675 springboot-openai-chatgpt · CVSS 6.9 Medium · Not analysed yet · Published 15 Mar 2025 · Tags: Hard-coded credentials
- [Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2024-13773.md)
  `CVE-2024-13773` · CVE record: uxper Civi - Job Board & Freelance Marketplace WordPress Theme · CVSS 7.3 High · Not analysed yet · Published 14 Mar 2025 · Tags: Hard-coded credentials
- [Philips Intellispace Cardiovascular (ISCV) Use of Weak Credentials](https://agentprime.io/advisories/CVE-2025-2229.md)
  `CVE-2025-2229` · CVE record: Philips Intellispace Cardiovascular (ISCV) · CVSS 8.5 High · Not analysed yet · Published 13 Mar 2025 · Tags: Hard-coded credentials
- [An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.](https://agentprime.io/advisories/CVE-2025-25749.md)
  `CVE-2025-25749` · CVE record · CVSS 7.1 High · Not analysed yet · Published 11 Mar 2025 · Tags: Hard-coded credentials
- [IBM Sterling File Gateway information disclosure](https://agentprime.io/advisories/CVE-2024-47109.md)
  `CVE-2024-47109` · CVE record: IBM Sterling File Gateway · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in GE Vernova EnerVista UR Setup](https://agentprime.io/advisories/CVE-2025-27255.md)
  `CVE-2025-27255` · CVE record: GE Vernova EnerVista UR Setup · CVSS 8.0 High · Not analysed yet · Published 10 Mar 2025 · Tags: Hard-coded credentials
- [Pass-Back vulnerability in Sage 200 Spain](https://agentprime.io/advisories/CVE-2025-1886.md)
  `CVE-2025-1886` · CVE record: Sage Sage 200 Spain · CVSS 7.1 High · Not analysed yet · Published 7 Mar 2025 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2024-12799.md)
  `CVE-2024-12799` · CVE record: OpenText Identity Manager Advanced Edition · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Weidmueller: Authentication Vulnerability due to Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-1393.md)
  `CVE-2025-1393` · CVE record: Weidmueller PROCON-WIN · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.](https://agentprime.io/advisories/CVE-2025-27674.md)
  `CVE-2025-27674` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.](https://agentprime.io/advisories/CVE-2025-27663.md)
  `CVE-2025-27663` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013.](https://agentprime.io/advisories/CVE-2025-27650.md)
  `CVE-2025-27650` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003.](https://agentprime.io/advisories/CVE-2025-27648.md)
  `CVE-2025-27648` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.](https://agentprime.io/advisories/CVE-2025-27643.md)
  `CVE-2025-27643` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.](https://agentprime.io/advisories/CVE-2025-27638.md)
  `CVE-2025-27638` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Hard-coded credentials
- [i-Drive i11/i12 APK hard-coded credentials](https://agentprime.io/advisories/CVE-2025-1879.md)
  `CVE-2025-1879` · CVE record: i-Drive i11 and 1 more · CVSS 2.4 Low · Not analysed yet · Published 3 Mar 2025 · Tags: Hard-coded credentials
- [IBM Engineering Requirements Management DOORS Next information disclosure](https://agentprime.io/advisories/CVE-2024-41771.md)
  `CVE-2024-41771` · CVE record: IBM Engineering Requirements Management DOORS Next · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2025 · Tags: Hard-coded credentials
- [IBM Engineering Requirements Management DOORS Next information disclosure](https://agentprime.io/advisories/CVE-2024-41770.md)
  `CVE-2024-41770` · CVE record: IBM Engineering Requirements Management DOORS Next · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2025 · Tags: Hard-coded credentials
- [IBM Controller information disclosure](https://agentprime.io/advisories/CVE-2024-41778.md)
  `CVE-2024-41778` · CVE record: IBM Controller · CVSS 5.3 Medium · Not analysed yet · Published 1 Mar 2025 · Tags: Hard-coded credentials
- [TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2025-25428.md)
  `CVE-2025-25428` · CVE record · CVSS 8.0 High · Not analysed yet · Published 28 Feb 2025 · Tags: Hard-coded credentials
- [Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB.](https://agentprime.io/advisories/CVE-2024-44754.md)
  `CVE-2024-44754` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 28 Feb 2025 · Tags: Hard-coded credentials
- [Information Disclosure in E-Kent's Pallium Vehicle Tracking](https://agentprime.io/advisories/CVE-2024-9334.md)
  `CVE-2024-9334` · CVE record: E-Kent Pallium Vehicle Tracking · CVSS 8.2 High · Not analysed yet · Published 27 Feb 2025 · Tags: Hard-coded credentials, CWE-921
- [Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.](https://agentprime.io/advisories/CVE-2025-25570.md)
  `CVE-2025-25570` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2025 · Tags: Hard-coded credentials
- [In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.](https://agentprime.io/advisories/CVE-2024-38291.md)
  `CVE-2024-38291` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 Feb 2025 · Tags: Broken access control, Hard-coded credentials
- [TP-Link TL-WR845N devices with firmware TL-WR845N(UN)\_V4_200909 and TL-WR845N(UN)\_V4_190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing down…](https://agentprime.io/advisories/CVE-2024-57040.md)
  `CVE-2024-57040` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2025 · Tags: Hard-coded credentials
- [SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials.](https://agentprime.io/advisories/CVE-2024-50688.md)
  `CVE-2024-50688` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2025 · Tags: Hard-coded credentials
- [Stored Credential Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-0760.md)
  `CVE-2025-0760` · CVE record: Tenable Tenable Identity Exposure · CVSS 2.7 Low · Not analysed yet · Published 25 Feb 2025 · Tags: Hard-coded credentials
- [Leantime has Insufficiently Protected Credentials](https://agentprime.io/advisories/GHSA-h6w8-27ph-c385.md)
  `GHSA-h6w8-27ph-c385`, `PKSA-m297-v654-1gjy` · Packagist `leantime/leantime`: affected `<3.3`, fixed in `3.3` · CVSS 4.0, no score published · Not analysed yet · Published 21 Feb 2025 · Tags: Hard-coded credentials
- [Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2024-37362.md)
  `CVE-2024-37362` · CVE record: Hitachi Vantara Pentaho Data Integration & Analytics and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Hard-coded credentials
- [IBM Cognos Controller information disclosure](https://agentprime.io/advisories/CVE-2024-52902.md)
  `CVE-2024-52902` · CVE record: IBM Cognos Controller and 1 more · CVSS 8.8 High · Not analysed yet · Published 19 Feb 2025 · Tags: Hard-coded credentials
- [PMWeb Setting weak password](https://agentprime.io/advisories/CVE-2025-1341.md)
  `CVE-2025-1341` · CVE record: PMWeb · CVSS 6.3 Medium · Not analysed yet · Published 16 Feb 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in GoodWe Technologies Co., Ltd. GW1500‑XS](https://agentprime.io/advisories/CVE-2024-8893.md)
  `CVE-2024-8893` · CVE record: GoodWe Technologies Co., Ltd. GW1500‑XS · CVSS 7.3 High · Not analysed yet · Published 14 Feb 2025 · Tags: Hard-coded credentials
- [Privilege Escalation in MEAC300](https://agentprime.io/advisories/CVE-2025-0867.md)
  `CVE-2025-0867` · CVE record: SICK AG SICK MEAC300 · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2025 · Tags: Hard-coded credentials
- [IXON B.V.](https://agentprime.io/advisories/CVE-2024-57790.md)
  `CVE-2024-57790` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 14 Feb 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Q-Free MaxTime](https://agentprime.io/advisories/CVE-2025-26340.md)
  `CVE-2025-26340` · CVE record: Q-Free MaxTime · CVSS 8.8 High · Not analysed yet · Published 12 Feb 2025 · Tags: Hard-coded credentials
- [Hard-coded password in Q-Free MaxTime](https://agentprime.io/advisories/CVE-2025-1100.md)
  `CVE-2025-1100` · CVE record: Q-Free MaxTime · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Fortinet FortiManager](https://agentprime.io/advisories/CVE-2024-33504.md)
  `CVE-2024-33504` · CVE record: Fortinet FortiManager · CVSS 3.9 Low · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Ivanti Connect Secure and others](https://agentprime.io/advisories/CVE-2024-13842.md)
  `CVE-2024-13842` · CVE record: Ivanti Connect Secure and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2025-26492.md)
  `CVE-2025-26492` · CVE record: JetBrains TeamCity · CVSS 7.7 High · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [Weak Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-26410.md)
  `CVE-2025-26410` · CVE record: Wattsense Wattsense Bridge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [SolarWinds Web Help Desk Cryptographic Key Management Vulnerability](https://agentprime.io/advisories/CVE-2024-28989.md)
  `CVE-2024-28989` · CVE record: SolarWinds Web Help Desk · CVSS 5.5 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [Billion Electric M120N - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-1143.md)
  `CVE-2025-1143` · CVE record: Billion Electric M100 and 3 more · CVSS 8.4 High · Not analysed yet · Published 11 Feb 2025 · Tags: Hard-coded credentials
- [Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera](https://agentprime.io/advisories/CVE-2025-1099.md)
  `CVE-2025-1099` · CVE record: TP-Link Tapo C500 V1 Wi-Fi Camera and 1 more · CVSS 7.0 High · Not analysed yet · Published 10 Feb 2025 · Tags: Hard-coded credentials
- [Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service.](https://agentprime.io/advisories/CVE-2024-46436.md)
  `CVE-2024-46436` · CVE record · CVSS 8.3 High · Not analysed yet · Published 10 Feb 2025 · Tags: Hard-coded credentials
- [A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the default rzadmin account with administrative pr…](https://agentprime.io/advisories/CVE-2024-46433.md)
  `CVE-2024-46433` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Feb 2025 · Tags: Hard-coded credentials
- [A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a default guest account with administrative priv…](https://agentprime.io/advisories/CVE-2024-46429.md)
  `CVE-2024-46429` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Feb 2025 · Tags: Hard-coded credentials
- [Use of Hard-Coded Password Vulnerability in ELI Electrocardiograph Devices](https://agentprime.io/advisories/CVE-2022-26388.md)
  `CVE-2022-26388` · CVE record: Welch Allyn ELI 380 Resting Electrocardiograph and 3 more · CVSS 6.4 Medium · Not analysed yet · Published 7 Feb 2025 · Tags: Hard-coded credentials
- [An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582.](https://agentprime.io/advisories/CVE-2024-52881.md)
  `CVE-2024-52881` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Feb 2025 · Tags: Hard-coded credentials
- [Bharti Airtel Xstream Fiber WiFi Password weak credentials](https://agentprime.io/advisories/CVE-2025-1081.md)
  `CVE-2025-1081` · CVE record: Bharti Airtel Xstream Fiber · CVSS 2.3 Low · Not analysed yet · Published 6 Feb 2025 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI1LTAyLTA2VDIwOjMxOjA3LjkwODAwMFoiLCJDVkUtMjAyNS0xMDgxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI1LTAzLTE4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS0zMDEyMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI1LTAzLTE4VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS0zMDEyMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.