# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Media CP Media Control Panel – insufficiently protected credential change](https://agentprime.io/advisories/CVE-2023-23466.md)
  `CVE-2023-23466` · CVE record: Media CP Media Control Panel · CVSS 6.5 Medium · Not analysed yet · Published 15 Feb 2023 · Tags: Hard-coded credentials
- [Sunell DVR – Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2023-23463.md)
  `CVE-2023-23463` · CVE record: Sunell DVR · CVSS 5.3 Medium · Not analysed yet · Published 15 Feb 2023 · Tags: Hard-coded credentials
- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-21705.md)
  `CVE-2023-21705` · CVE record: Microsoft Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) and 4 more · CVSS 8.8 High · Not analysed yet · Published 14 Feb 2023 · Tags: Hard-coded credentials
- [TIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability](https://agentprime.io/advisories/CVE-2022-41564.md)
  `CVE-2022-41564` · CVE record: TIBCO Software Inc. TIBCO Hawk and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Hard-coded credentials
- [EnOcean SmartServer Hard-coded credentials](https://agentprime.io/advisories/CVE-2022-3089.md)
  `CVE-2022-3089` · CVE record: EnOcean Smartserver · CVSS 6.3 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: Hard-coded credentials
- [Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password](https://agentprime.io/advisories/CVE-2023-0808.md)
  `CVE-2023-0808` · CVE record: Deye Inverter and 2 more · CVSS 3.9 Low · Not analysed yet · Published 13 Feb 2023 · Tags: Hard-coded credentials
- [Redpanda before 22.3.12 discloses cleartext AWS credentials.](https://agentprime.io/advisories/CVE-2023-24619.md)
  `CVE-2023-24619` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in FUJIFILM Business Innovation Corp. Driver Distributor](https://agentprime.io/advisories/CVE-2022-43460.md)
  `CVE-2022-43460` · CVE record: FUJIFILM Business Innovation Corp. Driver Distributor · CVSS 7.5 High · Not analysed yet · Published 13 Feb 2023 · Tags: Hard-coded credentials
- [Weak Password Requirements in thorsten/phpmyfaq](https://agentprime.io/advisories/GHSA-fxrq-xhj9-rf5j.md)
  `GHSA-fxrq-xhj9-rf5j`, `CVE-2023-0793`, `PKSA-fd1c-b7gm-rmg5` · Packagist `thorsten/phpmyfaq`: affected `<3.1.11`, fixed in `3.1.11` · CVSS 7.1 High · Not analysed yet · Published 12 Feb 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Dell PowerPath Management Appliance](https://agentprime.io/advisories/CVE-2022-34449.md)
  `CVE-2022-34449` · CVE record: Dell PowerPath Management Appliance · CVSS 6.0 Medium · Not analysed yet · Published 10 Feb 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Dell SupportAssist Client Consumer](https://agentprime.io/advisories/CVE-2022-34386.md)
  `CVE-2022-34386` · CVE record: Dell SupportAssist Client Consumer · CVSS 5.5 Medium · Not analysed yet · Published 10 Feb 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2023-21426.md)
  `CVE-2023-21426` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 4.3 Medium · Not analysed yet · Published 9 Feb 2023 · Tags: Hard-coded credentials
- [TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.](https://agentprime.io/advisories/CVE-2023-24155.md)
  `CVE-2023-24155` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2023 · Tags: Hard-coded credentials
- [TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.](https://agentprime.io/advisories/CVE-2023-24149.md)
  `CVE-2023-24149` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2023 · Tags: Hard-coded credentials
- [TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.](https://agentprime.io/advisories/CVE-2023-24147.md)
  `CVE-2023-24147` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Feb 2023 · Tags: Hard-coded credentials
- [PHPGurukul Employee Leaves Management System changepassword.php weak password](https://agentprime.io/advisories/CVE-2023-0641.md)
  `CVE-2023-0641` · CVE record: PHPGurukul Employee Leaves Management System · CVSS 3.7 Low · Not analysed yet · Published 2 Feb 2023 · Tags: Hard-coded credentials
- [A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request.](https://agentprime.io/advisories/CVE-2022-48113.md)
  `CVE-2022-48113` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2023 · Tags: Hard-coded credentials
- [Leaked user credentials in github.com/sylabs/scs-library-client](https://agentprime.io/advisories/GHSA-7p8m-22h4-9pj7.md)
  `GHSA-7p8m-22h4-9pj7`, `CVE-2022-23538`, `GO-2023-1497` · Go `github.com/sylabs/scs-library-client`: affected `<1.3.4 || >=1.4.0, <1.4.2`, fixed in `1.3.4`, `1.4.2` · CVSS 5.2 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: Hard-coded credentials
- [Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure.](https://agentprime.io/advisories/CVE-2023-23132.md)
  `CVE-2023-23132` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Feb 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in Schneider Electric APC Easy UPS Online Monitoring Software and others](https://agentprime.io/advisories/CVE-2022-42973.md)
  `CVE-2022-42973` · CVE record: Schneider Electric APC Easy UPS Online Monitoring Software and 1 more · CVSS 7.8 High · Not analysed yet · Published 1 Feb 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Schneider Electric Data Center Expert](https://agentprime.io/advisories/CVE-2022-32520.md)
  `CVE-2022-32520` · CVE record: Schneider Electric Data Center Expert · CVSS 8.0 High · Not analysed yet · Published 30 Jan 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Schneider Electric Data Center Expert](https://agentprime.io/advisories/CVE-2022-32518.md)
  `CVE-2022-32518` · CVE record: Schneider Electric Data Center Expert · CVSS 8.0 High · Not analysed yet · Published 30 Jan 2023 · Tags: Hard-coded credentials
- [Weak password requirements in Schneider Electric C-Bus Network Automation Controller, LSS5500NAC and others](https://agentprime.io/advisories/CVE-2022-32513.md)
  `CVE-2022-32513` · CVE record: Schneider Electric C-Bus Network Automation Controller, LSS5500NAC and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2023 · Tags: Hard-coded credentials
- [Publify contains Weak Password Requirements](https://agentprime.io/advisories/GHSA-g7gf-2rqw-5rwx.md)
  `GHSA-g7gf-2rqw-5rwx`, `BIT-publify-2023-0569`, `CVE-2023-0569` · RubyGems `publify_core`: affected `<9.2.10`, fixed in `9.2.10` · CVSS 8.1 High · Not analysed yet · Published 29 Jan 2023 · Tags: Hard-coded credentials
- [Froxlor contains Weak Password Requirements](https://agentprime.io/advisories/GHSA-pm72-27mg-fc28.md)
  `GHSA-pm72-27mg-fc28`, `CVE-2023-0564`, `PKSA-q6wt-gpp7-cn4g` · Packagist `froxlor/froxlor`: affected `<2.0.10`, fixed in `2.0.10` · CVSS 5.4 Medium · Not analysed yet · Published 29 Jan 2023 · Tags: Hard-coded credentials
- [An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.](https://agentprime.io/advisories/CVE-2022-48067.md)
  `CVE-2022-48067` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Jan 2023 · Tags: Hard-coded credentials
- [An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory.](https://agentprime.io/advisories/CVE-2022-46967.md)
  `CVE-2022-46967` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2023 · Tags: Hard-coded credentials
- [User Verification < 1.0.94 - Authentication Bypass](https://agentprime.io/advisories/CVE-2022-4693.md)
  `CVE-2022-4693` · CVE record: Unknown User Verification · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Cisco Industrial Network Director](https://agentprime.io/advisories/CVE-2023-20038.md)
  `CVE-2023-20038` · CVE record: Cisco Cisco Industrial Network Director · CVSS 8.8 High · Not analysed yet · Published 19 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Dell EMC Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2022-34442.md)
  `CVE-2022-34442` · CVE record: Dell EMC Secure Connect Gateway (SCG) Policy Manager · CVSS 8.0 High · Not analysed yet · Published 18 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Dell EMC Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2022-34462.md)
  `CVE-2022-34462` · CVE record: Dell EMC Secure Connect Gateway (SCG) Policy Manager · CVSS 8.4 High · Not analysed yet · Published 18 Jan 2023 · Tags: Hard-coded credentials
- [CVE-2022-45444](https://agentprime.io/advisories/CVE-2022-45444.md)
  `CVE-2022-45444` · CVE record: Sewio RTLS Studio · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jan 2023 · Tags: Hard-coded credentials
- [phpMyFAQ has Weak Password Requirements](https://agentprime.io/advisories/GHSA-4p88-cfhq-f3vg.md)
  `GHSA-4p88-cfhq-f3vg`, `CVE-2023-0307`, `PKSA-gy5j-hpdy-j8ts` · Packagist `thorsten/phpmyfaq`: affected `<3.1.10`, fixed in `3.1.10` · CVSS 5.7 Medium · Not analysed yet · Published 16 Jan 2023 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Metasys](https://agentprime.io/advisories/CVE-2021-36204.md)
  `CVE-2021-36204` · CVE record: Johnson Controls Metasys ADS/ADX/OAS · CVSS 7.8 High · Not analysed yet · Published 13 Jan 2023 · Tags: Hard-coded credentials
- [EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.](https://agentprime.io/advisories/CVE-2022-39185.md)
  `CVE-2022-39185` · CVE record: EXFO BV-10 Performance Endpoint Unit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2023 · Tags: Hard-coded credentials
- [Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key](https://agentprime.io/advisories/CVE-2017-5242.md)
  `CVE-2017-5242` · CVE record: Rapid7 Nexpose Virtual Appliance and 1 more · CVSS 7.7 High · Not analysed yet · Published 12 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2022-34441.md)
  `CVE-2022-34441` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 8.0 High · Not analysed yet · Published 11 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2022-34440.md)
  `CVE-2022-34440` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 8.4 High · Not analysed yet · Published 11 Jan 2023 · Tags: Hard-coded credentials
- [Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-21524.md)
  `CVE-2023-21524` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2023 · Tags: Hard-coded credentials
- [Insecure key generation for Zoom Rooms for macOS Clients](https://agentprime.io/advisories/CVE-2022-36925.md)
  `CVE-2022-36925` · CVE record: Zoom Video Communications Inc Zoom Rooms for macOS · CVSS 4.4 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Hard-coded credentials
- [CESNET theme-cesnet resetpassword.php insufficiently protected credentials](https://agentprime.io/advisories/CVE-2016-15014.md)
  `CVE-2016-15014` · CVE record: CESNET theme-cesnet · CVSS 3.3 Low · Not analysed yet · Published 7 Jan 2023 · Tags: Hard-coded credentials
- [Netis Netcore Router hard-coded password](https://agentprime.io/advisories/CVE-2018-25069.md)
  `CVE-2018-25069` · CVE record: Netis Netcore Router · CVSS 7.3 High · Not analysed yet · Published 7 Jan 2023 · Tags: Hard-coded credentials
- [KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys](https://agentprime.io/advisories/GHSA-vjhf-8vqx-vqpq.md)
  `GHSA-vjhf-8vqx-vqpq`, `CVE-2023-22463`, `GO-2023-1283` · Go `github.com/KubeOperator/kubepi`: affected `<1.6.3`, fixed in `1.6.3` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 6 Jan 2023 · Tags: Hard-coded credentials
- [Hardcoded credential is found in the message queue](https://agentprime.io/advisories/CVE-2022-3928.md)
  `CVE-2022-3928` · CVE record: Hitachi Energy FOXMAN-UN and 1 more · CVSS 7.1 High · Not analysed yet · Published 5 Jan 2023 · Tags: Hard-coded credentials
- [The affected products store public and private key that are used to sign and protect custom parameter set files from modification.](https://agentprime.io/advisories/CVE-2022-3927.md)
  `CVE-2022-3927` · CVE record: Hitachi Energy FOXMAN-UN and 1 more · CVSS 8.0 High · Not analysed yet · Published 5 Jan 2023 · Tags: Hard-coded credentials
- [Use of default key for encryption](https://agentprime.io/advisories/CVE-2021-40342.md)
  `CVE-2021-40342` · CVE record: Hitachi Energy FOXMAN-UN and 1 more · CVSS 7.1 High · Not analysed yet · Published 5 Jan 2023 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Prosys OPC UA Simulation Server and others](https://agentprime.io/advisories/CVE-2022-2967.md)
  `CVE-2022-2967` · CVE record: Prosys OPC UA Simulation Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 3 Jan 2023 · Tags: Hard-coded credentials
- [Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials](https://agentprime.io/advisories/CVE-2022-47618.md)
  `CVE-2022-47618` · CVE record: Merit Lilin Ent. Co., Ltd. AH55B04 DVR firmware and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jan 2023 · Tags: Hard-coded credentials
- [Weak password requirements in Kiwi TCMS](https://agentprime.io/advisories/CVE-2023-22451.md)
  `CVE-2023-22451` · CVE record: kiwitcms Kiwi · CVSS 6.5 Medium · Not analysed yet · Published 2 Jan 2023 · Tags: Hard-coded credentials
- [taoeffect Empress hard-coded password](https://agentprime.io/advisories/CVE-2014-125030.md)
  `CVE-2014-125030` · CVE record: taoeffect Empress · CVSS 6.3 Medium · Not analysed yet · Published 1 Jan 2023 · Tags: Hard-coded credentials
- [Hard-coded credentials in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2](https://agentprime.io/advisories/CVE-2022-45425.md)
  `CVE-2022-45425` · CVE record: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 · CVSS 7.5 High · Not analysed yet · Published 27 Dec 2022 · Tags: Hard-coded credentials
- [Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.](https://agentprime.io/advisories/CVE-2022-36222.md)
  `CVE-2022-36222` · CVE record · CVSS 8.4 High · Not analysed yet · Published 21 Dec 2022 · Tags: Hard-coded credentials
- [Click Studios Passwordstate insufficiently protected credentials](https://agentprime.io/advisories/CVE-2022-4612.md)
  `CVE-2022-4612` · CVE record: Click Studios Passwordstate and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 19 Dec 2022 · Tags: Hard-coded credentials
- [Click Studios Passwordstate hard-coded credentials](https://agentprime.io/advisories/CVE-2022-4611.md)
  `CVE-2022-4611` · CVE record: Click Studios Passwordstate and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 19 Dec 2022 · Tags: Hard-coded credentials
- [Mutiny 7.2.0-10788 suffers from Hardcoded root password.](https://agentprime.io/advisories/CVE-2022-37832.md)
  `CVE-2022-37832` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2022 · Tags: Hard-coded credentials
- [Common Key Vulnerability in Serv-U FTP Server](https://agentprime.io/advisories/CVE-2021-35252.md)
  `CVE-2021-35252` · CVE record: SolarWinds Serv-U FTP Server · CVSS 7.5 High · Not analysed yet · Published 16 Dec 2022 · Tags: Hard-coded credentials
- [Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.](https://agentprime.io/advisories/CVE-2022-44236.md)
  `CVE-2022-44236` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2022 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Delta Electronics Industrial Automation DIALink](https://agentprime.io/advisories/CVE-2022-2660.md)
  `CVE-2022-2660` · CVE record: Delta Electronics Industrial Automation DIALink · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2022 · Tags: Hard-coded credentials
- [Hard-coded password in Daikin SVMPC1 and others](https://agentprime.io/advisories/CVE-2022-41653.md)
  `CVE-2022-41653` · CVE record: Daikin SVMPC1 and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Dec 2022 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in Horner Automation Remote Compact Controller (RCC) 972](https://agentprime.io/advisories/CVE-2022-2641.md)
  `CVE-2022-2641` · CVE record: Horner Automation Remote Compact Controller (RCC) 972 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2022 · Tags: Hard-coded credentials

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDIyLTEyLTEyVDAxOjQ5OjEwLjAwODAwMFoiLCJDVkUtMjAyMi0yNjQxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDIzLTAyLTE1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNDQ5OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDIzLTAyLTE1VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNDQ5OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.