# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2023-37291.md)
  `CVE-2023-37291` · CVE record: Galaxy Software Services Vitals ESP · CVSS 8.6 High · Not analysed yet · Published 21 Jul 2023 · Tags: Hard-coded credentials
- [Weintek Weincloud Improper Authentication](https://agentprime.io/advisories/CVE-2023-37362.md)
  `CVE-2023-37362` · CVE record: Weintek Weincloud · CVSS 7.2 High · Not analysed yet · Published 19 Jul 2023 · Tags: Hard-coded credentials
- [Weave GitOps Terraform Controller Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-6hvv-j432-23cv.md)
  `GHSA-6hvv-j432-23cv`, `CVE-2023-34236`, `GO-2023-1925` · Go `github.com/weaveworks/tf-controller`: affected `<0.14.4 || >=0.15.0-rc.1, <0.15.0-rc.5`, fixed in `0.14.4`, `0.15.0-rc.5` · CVSS 8.5 High · Not analysed yet · Published 14 Jul 2023 · Tags: Information disclosure, Hard-coded credentials
- [An issue found in DERICIA Co.](https://agentprime.io/advisories/CVE-2023-31824.md)
  `CVE-2023-31824` · CVE record · No CVSS score · Not analysed yet · Published 13 Jul 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in SonicWall GMS and others](https://agentprime.io/advisories/CVE-2023-34123.md)
  `CVE-2023-34123` · CVE record: SonicWall GMS and 1 more · No CVSS score · Not analysed yet · Published 12 Jul 2023 · Tags: Hard-coded credentials
- [Jenkins mabl Plugin vulnerable to exposure of system-scooped credentials](https://agentprime.io/advisories/GHSA-4c3q-r84r-q6pp.md)
  `GHSA-4c3q-r84r-q6pp`, `CVE-2023-37951` · Maven `com.mabl.integration.jenkins:mabl-integration`: affected `<0.0.47`, fixed in `0.0.47` · CVSS 6.5 Medium · Not analysed yet · Published 12 Jul 2023 · Tags: Hard-coded credentials
- [Active Directory Federation Service Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-35348.md)
  `CVE-2023-35348` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Jul 2023 · Tags: Hard-coded credentials
- [SmartBPM.NET - Use of Hard-Coded Credentials - 2](https://agentprime.io/advisories/CVE-2023-37287.md)
  `CVE-2023-37287` · CVE record: SamrtSoft SmartBPM.NET · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2023 · Tags: Hard-coded credentials
- [SmartBPM.NET - Use of Hard-Coded Credentials - 1](https://agentprime.io/advisories/CVE-2023-37286.md)
  `CVE-2023-37286` · CVE record: SamrtSoft SmartBPM.NET · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2023 · Tags: Hard-coded credentials
- [PiiGAB M-Bus Weak Password Requirements](https://agentprime.io/advisories/CVE-2023-34995.md)
  `CVE-2023-34995` · CVE record: PiiGAB M-Bus SoftwarePack · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2023 · Tags: Hard-coded credentials
- [PiiGAB M-Bus Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-35987.md)
  `CVE-2023-35987` · CVE record: PiiGAB M-Bus SoftwarePack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2023 · Tags: Hard-coded credentials
- [Apache InLong has Weak Password Requirements in Apache InLong](https://agentprime.io/advisories/GHSA-w3wr-gmwf-r333.md)
  `GHSA-w3wr-gmwf-r333`, `CVE-2023-31098` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.1.0, <1.47.0`, fixed in `1.47.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2023 · Tags: Hard-coded credentials
- [Apache Superset vulnerable to Exposure of Sensitive Information](https://agentprime.io/advisories/GHSA-cmjc-52fg-9f7j.md)
  `GHSA-cmjc-52fg-9f7j`, `BIT-superset-2023-30776`, `CVE-2023-30776`, `PYSEC-2026-1171` · PyPI `apache-superset`: affected `>=1.3.0, <2.1.0`, fixed in `2.1.0` · CVSS 4.9 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: Information disclosure, Hard-coded credentials
- [Hard-coded cryptographic key in MilesightVPN](https://agentprime.io/advisories/CVE-2023-22844.md)
  `CVE-2023-22844` · CVE record: Milesight MilesightVPN · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2023 · Tags: Hard-coded credentials
- [Usage of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-34473.md)
  `CVE-2023-34473` · CVE record: AMI MegaRAC_SPx · CVSS 6.6 Medium · Not analysed yet · Published 5 Jul 2023 · Tags: Hard-coded credentials
- [hard coded cryptographic key](https://agentprime.io/advisories/CVE-2023-34338.md)
  `CVE-2023-34338` · CVE record: AMI MegaRAC_SPx · CVSS 7.1 High · Not analysed yet · Published 5 Jul 2023 · Tags: Hard-coded credentials
- [The King's Temple Church website Leaked Stripe API Key in Public Code Repository](https://agentprime.io/advisories/CVE-2023-36817.md)
  `CVE-2023-36817` · CVE record: tktchurch website · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2023 · Tags: Information disclosure, Hard-coded credentials
- [Weak passwords allowed in cloudexplorer-lite](https://agentprime.io/advisories/CVE-2023-34240.md)
  `CVE-2023-34240` · CVE record: CloudExplorer-Dev CloudExplorer-Lite · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2023 · Tags: Hard-coded credentials
- [Weak Password Requirements in cloudexplorer-dev/cloudexplorer-lite](https://agentprime.io/advisories/CVE-2023-3423.md)
  `CVE-2023-3423` · CVE record: cloudexplorer-dev cloudexplorer-dev/cloudexplorer-lite · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2023 · Tags: Hard-coded credentials
- [EmbedPress <= 3.7.3 - Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2023-3371.md)
  `CVE-2023-3371` · CVE record: wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more · CVSS 5.3 Medium · Not analysed yet · Published 27 Jun 2023 · Tags: Hard-coded credentials
- [Advantech R-SeeNet Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-2611.md)
  `CVE-2023-2611` · CVE record: Advantech R-SeeNet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2023 · Tags: Hard-coded credentials
- [Enphase Installer Toolkit Android App Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-32274.md)
  `CVE-2023-32274` · CVE record: Enphase Enphase Installer Toolkit · CVSS 8.6 High · Not analysed yet · Published 20 Jun 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support](https://agentprime.io/advisories/CVE-2023-30904.md)
  `CVE-2023-30904` · CVE record: Hewlett Packard Enterprise (HPE) HPE Insight Remote Support · No CVSS score · Not analysed yet · Published 16 Jun 2023 · Tags: Hard-coded credentials
- [An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B.](https://agentprime.io/advisories/CVE-2023-25187.md)
  `CVE-2023-25187` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 16 Jun 2023 · Tags: Hard-coded credentials
- [OTCMS hard-coded password](https://agentprime.io/advisories/CVE-2023-3237.md)
  `CVE-2023-3237` · CVE record: OTCMS · CVSS 6.3 Medium · Not analysed yet · Published 14 Jun 2023 · Tags: Hard-coded credentials
- [Rockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic Key](https://agentprime.io/advisories/CVE-2023-2637.md)
  `CVE-2023-2637` · CVE record: Rockwell Automation FactoryTalk System Services · CVSS 7.3 High · Not analysed yet · Published 13 Jun 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Siemens CP-8031 MASTER MODULE and others](https://agentprime.io/advisories/CVE-2023-33920.md)
  `CVE-2023-33920` · CVE record: Siemens CP-8031 MASTER MODULE and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: Hard-coded credentials
- [PTC Vuforia Studio Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2023-29168.md)
  `CVE-2023-29168` · CVE record: PTC Vuforia Studio · CVSS 3.7 Low · Not analysed yet · Published 7 Jun 2023 · Tags: Hard-coded credentials
- [The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras.](https://agentprime.io/advisories/CVE-2023-27126.md)
  `CVE-2023-27126` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 6 Jun 2023 · Tags: Hard-coded credentials
- [Privilege escalation to root](https://agentprime.io/advisories/CVE-2023-0635.md)
  `CVE-2023-0635` · CVE record: ABB Ltd. ASPECT®-Enterprise and 2 more · CVSS 7.8 High · Not analysed yet · Published 5 Jun 2023 · Tags: Hard-coded credentials
- [Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules](https://agentprime.io/advisories/CVE-2023-2061.md)
  `CVE-2023-2061` · CVE record: Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 2 Jun 2023 · Tags: Hard-coded credentials
- [Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules](https://agentprime.io/advisories/CVE-2023-2060.md)
  `CVE-2023-2060` · CVE record: Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and 1 more · CVSS 7.5 High · Not analysed yet · Published 2 Jun 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Mozilla Firefox](https://agentprime.io/advisories/CVE-2023-25740.md)
  `CVE-2023-25740` · CVE record: Mozilla Firefox · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2023 · Tags: Hard-coded credentials
- [Hitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2022-47617.md)
  `CVE-2022-47617` · CVE record: Hitron Technologies Inc. Hitron CODA-5310 · CVSS 7.2 High · Not analysed yet · Published 2 Jun 2023 · Tags: Hard-coded credentials
- [Sprecher: Sprecon maintenance access with hardcoded credentials](https://agentprime.io/advisories/CVE-2022-4333.md)
  `CVE-2022-4333` · CVE record: Sprecher Automation SPRECON-E CPU PU243x and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2023 · Tags: Hard-coded credentials
- [Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discove…](https://agentprime.io/advisories/CVE-2023-33778.md)
  `CVE-2023-33778` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in SAISON INFORMATION SYSTEMS CO.,LTD. DataSpider Servista](https://agentprime.io/advisories/CVE-2023-28937.md)
  `CVE-2023-28937` · CVE record: SAISON INFORMATION SYSTEMS CO.,LTD. DataSpider Servista · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2023 · Tags: Hard-coded credentials
- [Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2023-31187.md)
  `CVE-2023-31187` · CVE record: Avaya IX Workforce Engagement · CVSS 6.5 Medium · Not analysed yet · Published 30 May 2023 · Tags: Hard-coded credentials
- [ROZCOM client](https://agentprime.io/advisories/CVE-2023-31184.md)
  `CVE-2023-31184` · CVE record: ROZCOM client · CVSS 6.2 Medium · Not analysed yet · Published 30 May 2023 · Tags: Hard-coded credentials
- [Insufficiently Protected ChatBot Credentials in tgstation-server](https://agentprime.io/advisories/CVE-2023-32687.md)
  `CVE-2023-32687` · CVE record: tgstation tgstation-server · CVSS 7.7 High · Not analysed yet · Published 29 May 2023 · Tags: Hard-coded credentials
- [Pimcore customers' list user password hash is disclosed](https://agentprime.io/advisories/GHSA-j65r-g7q2-f8v3.md)
  `GHSA-j65r-g7q2-f8v3`, `CVE-2023-2881`, `PKSA-kq1d-6py7-szwx` · Packagist `pimcore/customer-management-framework-bundle`: affected `<3.3.10`, fixed in `3.3.10` · CVSS 6.7 Medium · Not analysed yet · Published 25 May 2023 · Tags: Hard-coded credentials, CWE-257
- [In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory.](https://agentprime.io/advisories/CVE-2023-33263.md)
  `CVE-2023-33263` · CVE record · CVSS 7.5 High · Not analysed yet · Published 25 May 2023 · Tags: Hard-coded credentials
- [\[minikube\] ssh server with default password](https://agentprime.io/advisories/CVE-2023-1944.md)
  `CVE-2023-1944` · CVE record: Kubernetes minikube · CVSS 8.4 High · Not analysed yet · Published 24 May 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in JINS Inc. JINS MEME CORE](https://agentprime.io/advisories/CVE-2023-27921.md)
  `CVE-2023-27921` · CVE record: JINS Inc. JINS MEME CORE · CVSS 6.5 Medium · Not analysed yet · Published 23 May 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in BirdDog STUDIO R3 and others](https://agentprime.io/advisories/CVE-2023-2504.md)
  `CVE-2023-2504` · CVE record: BirdDog STUDIO R3 and 3 more · CVSS 8.4 High · Not analysed yet · Published 22 May 2023 · Tags: Hard-coded credentials
- [Weak credentials in Snap One OvrC Cloud](https://agentprime.io/advisories/CVE-2023-31240.md)
  `CVE-2023-31240` · CVE record: Snap One OvrC Cloud · CVSS 8.3 High · Not analysed yet · Published 22 May 2023 · Tags: Hard-coded credentials
- [MXsecurity Hardcoded Credential Vulnerability](https://agentprime.io/advisories/CVE-2023-33236.md)
  `CVE-2023-33236` · CVE record: Moxa MXsecurity Series · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2023 · Tags: Hard-coded credentials
- [Hazelcast vulnerable to unmasked password exposure](https://agentprime.io/advisories/GHSA-5gj6-62g7-vmgf.md)
  `GHSA-5gj6-62g7-vmgf`, `CVE-2023-33264` · Maven `com.hazelcast:hazelcast`: affected `>=4.0-BETA-1, <=4.2.8 || >=5.0-BETA-1, <5.0.5 || >=5.1-BETA-1, <5.1.6 || >=5.2-BETA-1, <5.2.4 || >=5.3.0-BETA-1, <5.3.0`, fixed in `5.0.5`, `5.1.6`, `5.2.4`, `5.3.0` · CVSS 4.3 Medium · Not analysed yet · Published 22 May 2023 · Tags: Information disclosure, Hard-coded credentials
- [cnoa OA hard-coded password](https://agentprime.io/advisories/CVE-2023-2799.md)
  `CVE-2023-2799` · CVE record: cnoa OA · CVSS 6.3 Medium · Not analysed yet · Published 18 May 2023 · Tags: Hard-coded credentials
- [Jenkins Azure VM Agents Plugin missing permission checks](https://agentprime.io/advisories/GHSA-q77x-cxrq-988j.md)
  `GHSA-q77x-cxrq-988j`, `CVE-2023-32988` · Maven `org.jenkins-ci.plugins:azure-vm-agents`: affected `<853.v4a`, fixed in `853.v4a` · CVSS 4.3 Medium · Not analysed yet · Published 16 May 2023 · Tags: Hard-coded credentials
- [Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking](https://agentprime.io/advisories/GHSA-gqxr-hvrw-6hfh.md)
  `GHSA-gqxr-hvrw-6hfh`, `CVE-2023-33000` · Maven `io.jenkins.plugins:cavisson-ns-nd-integration`: affected `<4.11.0.48`, fixed in `4.11.0.48` · CVSS 3.1 Low · Not analysed yet · Published 16 May 2023 · Tags: Hard-coded credentials
- [Jenkins Code Dx Plugin stores API keys in plain text](https://agentprime.io/advisories/GHSA-gpc2-f62m-c6h6.md)
  `GHSA-gpc2-f62m-c6h6`, `CVE-2023-2632` · Maven `org.jenkins-ci.plugins:codedx`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 May 2023 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Code Dx Plugin displays API keys in plain text](https://agentprime.io/advisories/GHSA-352v-hhmh-2w8h.md)
  `GHSA-352v-hhmh-2w8h`, `CVE-2023-2633` · Maven `org.jenkins-ci.plugins:codedx`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 May 2023 · Tags: Hard-coded credentials, CWE-256
- [An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleart…](https://agentprime.io/advisories/CVE-2022-47880.md)
  `CVE-2022-47880` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 12 May 2023 · Tags: Hard-coded credentials
- [USR USR-G806 Web Management Page hard-coded password](https://agentprime.io/advisories/CVE-2023-2645.md)
  `CVE-2023-2645` · CVE record: USR USR-G806 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Intel(R) DCM software](https://agentprime.io/advisories/CVE-2022-40685.md)
  `CVE-2022-40685` · CVE record: Intel(R) DCM software · CVSS 6.5 Medium · Not analysed yet · Published 10 May 2023 · Tags: Hard-coded credentials
- [Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserte…](https://agentprime.io/advisories/CVE-2023-30354.md)
  `CVE-2023-30354` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 May 2023 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.](https://agentprime.io/advisories/CVE-2023-30352.md)
  `CVE-2023-30352` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 May 2023 · Tags: Hard-coded credentials
- [Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption.](https://agentprime.io/advisories/CVE-2023-30351.md)
  `CVE-2023-30351` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 May 2023 · Tags: Hard-coded credentials
- [Weak password requirements in Seiko Solutions Inc. SkyBridge MB-A200, SkyBridge BASIC MB-A130…](https://agentprime.io/advisories/CVE-2023-25184.md)
  `CVE-2023-25184` · CVE record: Seiko Solutions Inc. SkyBridge MB-A200, SkyBridge BASIC MB-A130, and SkySpider MB-R210 · CVSS 5.3 Medium · Not analysed yet · Published 10 May 2023 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDIzLTA1LTEwVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNTE4NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDIzLTA3LTI1VDEzOjUzOjQyLjAwMDAwMFoiLCJHSFNBLXZmNzgtM3E5Zi05MmczIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDIzLTA3LTI1VDEzOjUzOjQyLjAwMDAwMFoiLCJHSFNBLXZmNzgtM3E5Zi05MmczIl0>. Everything for agents: <https://agentprime.io/llms.txt>.