# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Weak password requirements in Seiko Solutions Inc. SkyBridge MB-A100/110](https://agentprime.io/advisories/CVE-2023-25072.md)
  `CVE-2023-25072` · CVE record: Seiko Solutions Inc. SkyBridge MB-A100/110 · CVSS 6.5 Medium · Not analysed yet · Published 10 May 2023 · Tags: Hard-coded credentials
- [PostgresNIO processes unencrypted bytes from man-in-the-middle](https://agentprime.io/advisories/CVE-2023-31136.md)
  `CVE-2023-31136` · CVE record: vapor postgres-nio · CVSS 3.7 Low · Not analysed yet · Published 9 May 2023 · Tags: Hard-coded credentials
- [Hard-coded password in Siemens SIMATIC Cloud Connect 7 CC712 and others](https://agentprime.io/advisories/CVE-2023-29103.md)
  `CVE-2023-29103` · CVE record: Siemens SIMATIC Cloud Connect 7 CC712 and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 9 May 2023 · Tags: Hard-coded credentials
- [Information Disclosure vulnerability in SAP BusinessObjects Platform](https://agentprime.io/advisories/CVE-2023-28764.md)
  `CVE-2023-28764` · CVE record: SAP_SE SAP BusinessObjects Platform · CVSS 3.7 Low · Not analysed yet · Published 9 May 2023 · Tags: Hard-coded credentials
- [Milesight NCR/Camera CWE-522: Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2023-24506.md)
  `CVE-2023-24506` · CVE record: Milesight NCR/Camera · CVSS 7.5 High · Not analysed yet · Published 8 May 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2023-21404.md)
  `CVE-2023-21404` · CVE record: Axis Communications AB AXIS OS · CVSS 4.1 Medium · Not analysed yet · Published 8 May 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiNAC](https://agentprime.io/advisories/CVE-2023-26203.md)
  `CVE-2023-26203` · CVE record: Fortinet FortiNAC · CVSS 6.1 Medium · Not analysed yet · Published 3 May 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Fortinet FortiNAC](https://agentprime.io/advisories/CVE-2022-45859.md)
  `CVE-2022-45859` · CVE record: Fortinet FortiNAC · CVSS 3.9 Low · Not analysed yet · Published 3 May 2023 · Tags: Hard-coded credentials
- [European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing.](https://agentprime.io/advisories/CVE-2023-26089.md)
  `CVE-2023-26089` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 May 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Lenovo XClarity Controller](https://agentprime.io/advisories/CVE-2023-25495.md)
  `CVE-2023-25495` · CVE record: Lenovo XClarity Controller · CVSS 4.9 Medium · Not analysed yet · Published 28 Apr 2023 · Tags: Hard-coded credentials
- [Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory.](https://agentprime.io/advisories/CVE-2022-41400.md)
  `CVE-2022-41400` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2023 · Tags: Hard-coded credentials
- [The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database fo…](https://agentprime.io/advisories/CVE-2022-41399.md)
  `CVE-2022-41399` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2023 · Tags: Hard-coded credentials
- [The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance.](https://agentprime.io/advisories/CVE-2022-41398.md)
  `CVE-2022-41398` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2023 · Tags: Hard-coded credentials
- [The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration…](https://agentprime.io/advisories/CVE-2022-41397.md)
  `CVE-2022-41397` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2023 · Tags: Hard-coded credentials
- [Impersonation through User-Controlled Token](https://agentprime.io/advisories/CVE-2023-2158.md)
  `CVE-2023-2158` · CVE record: Synopsys Code Dx · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2023 · Tags: Hard-coded credentials
- [Potential leak of authentication data to 3rd parties](https://agentprime.io/advisories/GHSA-558p-m34m-vpmq.md)
  `GHSA-558p-m34m-vpmq`, `CVE-2023-30846` · npm `typed-rest-client`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2023 · Tags: Hard-coded credentials
- [Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables.](https://agentprime.io/advisories/CVE-2023-26567.md)
  `CVE-2023-26567` · CVE record · CVSS 8.1 High · Not analysed yet · Published 26 Apr 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Zoho ManageEngine Multiple Products](https://agentprime.io/advisories/CVE-2023-2291.md)
  `CVE-2023-2291` · CVE record: Zoho ManageEngine Multiple Products · CVSS 7.8 High · Not analysed yet · Published 26 Apr 2023 · Tags: Hard-coded credentials
- [An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials.](https://agentprime.io/advisories/CVE-2022-39989.md)
  `CVE-2022-39989` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2023 · Tags: Hard-coded credentials
- [HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens](https://agentprime.io/advisories/CVE-2023-28084.md)
  `CVE-2023-28084` · CVE record: Hewlett Packard Enterprise HPE OneView and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2023-28090.md)
  `CVE-2023-28090` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 5.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2023-28089.md)
  `CVE-2023-28089` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 7.1 High · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2023-28088.md)
  `CVE-2023-28088` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 7.8 High · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2023-28087.md)
  `CVE-2023-28087` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 5.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2023-28086.md)
  `CVE-2023-28086` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 5.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php.](https://agentprime.io/advisories/CVE-2022-45291.md)
  `CVE-2022-45291` · CVE record · CVSS 7.2 High · Not analysed yet · Published 25 Apr 2023 · Tags: Hard-coded credentials
- [Expo SDK has an OAuth vulnerability](https://agentprime.io/advisories/GHSA-wr5g-q49g-548w.md)
  `GHSA-wr5g-q49g-548w`, `CVE-2023-28131` · npm `expo`: affected `<48.0.0`, fixed in `48.0.0` · CVSS 9.6 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.23 · Not analysed yet · Published 24 Apr 2023 · Tags: Hard-coded credentials
- [EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configur…](https://agentprime.io/advisories/CVE-2023-31043.md)
  `CVE-2023-31043` · CVE record · CVSS 7.5 High · Not analysed yet · Published 23 Apr 2023 · Tags: Hard-coded credentials
- [Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.](https://agentprime.io/advisories/CVE-2021-33589.md)
  `CVE-2021-33589` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2023 · Tags: Hard-coded credentials
- [Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request payload](https://agentprime.io/advisories/CVE-2023-25760.md)
  `CVE-2023-25760` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Apr 2023 · Tags: Hard-coded credentials
- [Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.](https://agentprime.io/advisories/GHSA-9gxx-32p7-ff7m.md)
  `GHSA-9gxx-32p7-ff7m`, `CVE-2023-2160`, `PYSEC-2023-34` · PyPI `modoboa`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: Hard-coded credentials
- [@nuxtlabs/github-module made Use of Hard-coded Credentials](https://agentprime.io/advisories/GHSA-fp2w-g92g-fgq4.md)
  `GHSA-fp2w-g92g-fgq4`, `CVE-2023-2138` · npm `@nuxtlabs/github-module`: affected `<1.6.2`, fixed in `1.6.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Apr 2023 · Tags: Hard-coded credentials
- [Electra Central AC unit – Easily calculated password](https://agentprime.io/advisories/CVE-2023-24502.md)
  `CVE-2023-24502` · CVE record: Electra Electra Central AC unit · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2023 · Tags: Hard-coded credentials
- [Electra Central AC unit – Hardcoded Credentials](https://agentprime.io/advisories/CVE-2023-24501.md)
  `CVE-2023-24501` · CVE record: Electra Electra Central AC unit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2023 · Tags: Hard-coded credentials
- [TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603.](https://agentprime.io/advisories/CVE-2022-37255.md)
  `CVE-2022-37255` · CVE record · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2023 · Tags: Hard-coded credentials
- [Weak Password Requirements in calibreweb](https://agentprime.io/advisories/GHSA-mhmp-m6g7-7c24.md)
  `GHSA-mhmp-m6g7-7c24`, `CVE-2023-2106`, `PYSEC-2026-1233` · PyPI `calibreweb`: affected `<0.6.20`, fixed in `0.6.20` · CVSS 7.3 High · Not analysed yet · Published 15 Apr 2023 · Tags: Hard-coded credentials
- [Weak credentials in TP-Link Corporation Limited T2600G-28SQ](https://agentprime.io/advisories/CVE-2023-28368.md)
  `CVE-2023-28368` · CVE record: TP-Link Corporation Limited T2600G-28SQ · CVSS 5.7 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: Hard-coded credentials
- [Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-25413.md)
  `CVE-2023-25413` · CVE record · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2023 · Tags: Hard-coded credentials
- [Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2023-25407.md)
  `CVE-2023-25407` · CVE record · CVSS 7.2 High · Not analysed yet · Published 11 Apr 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Wolt Delivery: Food and more](https://agentprime.io/advisories/CVE-2023-22429.md)
  `CVE-2023-22429` · CVE record: Wolt Wolt Delivery: Food and more · CVSS 7.8 High · Not analysed yet · Published 11 Apr 2023 · Tags: Hard-coded credentials
- [IBM Sterling Order Management information disclosure](https://agentprime.io/advisories/CVE-2022-34333.md)
  `CVE-2022-34333` · CVE record: IBM Sterling Order Management · CVSS 5.9 Medium · Not analysed yet · Published 7 Apr 2023 · Tags: Hard-coded credentials
- [phpMyFAQ has weak password requirements](https://agentprime.io/advisories/GHSA-4p4m-5qp7-479x.md)
  `GHSA-4p4m-5qp7-479x`, `CVE-2023-1753`, `PKSA-55zv-d6h5-byt9` · Packagist `thorsten/phpmyfaq`: affected `<3.1.12`, fixed in `3.1.12` · CVSS 5.5 Medium · Not analysed yet · Published 31 Mar 2023 · Tags: Hard-coded credentials
- [Authentication bypass in UniRPC's udadmin service](https://agentprime.io/advisories/CVE-2023-28503.md)
  `CVE-2023-28503` · CVE record: Rocket Software UniData and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.61 · Not analysed yet · Published 29 Mar 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-48433.md)
  `CVE-2022-48433` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.1 Medium · Not analysed yet · Published 29 Mar 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in CP Plus KVMS Pro](https://agentprime.io/advisories/CVE-2023-1518.md)
  `CVE-2023-1518` · CVE record: CP Plus KVMS Pro · CVSS 7.8 High · Not analysed yet · Published 28 Mar 2023 · Tags: Hard-coded credentials
- [VARTA: Multiple devices prone to hard-coded credentials](https://agentprime.io/advisories/CVE-2022-22512.md)
  `CVE-2022-22512` · CVE record: VARTA Storage Element backup and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Devolutions Remote Desktop Manager](https://agentprime.io/advisories/CVE-2023-1574.md)
  `CVE-2023-1574` · CVE record: Devolutions Remote Desktop Manager · CVSS 6.5 Medium · Not analysed yet · Published 22 Mar 2023 · Tags: Hard-coded credentials
- [MGT-COMMERCE CloudPanel Shared Certificate](https://agentprime.io/advisories/CVE-2023-0391.md)
  `CVE-2023-0391` · CVE record: MGT-COMMERCE CloudPanel · CVSS 8.1 High · Not analysed yet · Published 21 Mar 2023 · Tags: Hard-coded credentials
- [An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy.](https://agentprime.io/advisories/CVE-2022-45635.md)
  `CVE-2022-45635` · CVE record · CVSS 7.5 High · Not analysed yet · Published 21 Mar 2023 · Tags: Hard-coded credentials
- [A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taki…](https://agentprime.io/advisories/CVE-2023-26511.md)
  `CVE-2023-26511` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Mar 2023 · Tags: Hard-coded credentials
- [Panindex uses hard coded cyptographic key](https://agentprime.io/advisories/CVE-2023-27583.md)
  `CVE-2023-27583` · CVE record: px-org PanIndex · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Mar 2023 · Tags: Hard-coded credentials
- [Easy!Appointments uses hard-coded credentials](https://agentprime.io/advisories/GHSA-347f-rxg8-qgrv.md)
  `GHSA-347f-rxg8-qgrv`, `CVE-2023-1269`, `PKSA-h83m-6xpp-14tj` · Packagist `alextselegidis/easyappointments`: affected `<=1.4.3`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 8 Mar 2023 · Tags: Hard-coded credentials
- [Update share links to use FRP instead of SSH tunneling](https://agentprime.io/advisories/GHSA-3x5j-9vwr-8rr5.md)
  `GHSA-3x5j-9vwr-8rr5`, `CVE-2023-25823`, `PYSEC-2023-16` · PyPI `gradio`: affected `<3.13.1`, fixed in `3.13.1` · CVSS 5.4 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: Hard-coded credentials
- [Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key Vulnerability](https://agentprime.io/advisories/CVE-2023-20016.md)
  `CVE-2023-20016` · CVE record: Cisco Cisco Unified Computing System (Managed) · CVSS 6.3 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: Hard-coded credentials
- [Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regar…](https://agentprime.io/advisories/CVE-2022-45599.md)
  `CVE-2022-45599` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Feb 2023 · Tags: Hard-coded credentials
- [Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.](https://agentprime.io/advisories/CVE-2022-46637.md)
  `CVE-2022-46637` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Fortinet FortiNAC](https://agentprime.io/advisories/CVE-2022-40678.md)
  `CVE-2022-40678` · CVE record: Fortinet FortiNAC · CVSS 7.4 High · Not analysed yet · Published 16 Feb 2023 · Tags: Hard-coded credentials
- [Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.](https://agentprime.io/advisories/CVE-2022-43969.md)
  `CVE-2022-43969` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Feb 2023 · Tags: Hard-coded credentials
- [AMI MegaRAC SPX devices allow Password Disclosure through Redfish.](https://agentprime.io/advisories/CVE-2023-25191.md)
  `CVE-2023-25191` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Feb 2023 · Tags: Hard-coded credentials
- [Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.](https://agentprime.io/advisories/CVE-2023-24498.md)
  `CVE-2023-24498` · CVE record: Netgear ProSAFE 24 Port 10/100 FS726TP · CVSS 7.5 High · Not analysed yet · Published 15 Feb 2023 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDIzLTAyLTE1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNDQ5OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDIzLTA1LTEwVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNTE4NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDIzLTA1LTEwVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNTE4NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.