CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-798

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2020-27278 798 2021-03-15 2021-03-22
3.6
None Local Low Not required Partial Partial None
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin privileges for the device’s configuration interface.
152 CVE-2020-27256 798 2021-01-19 2021-01-23
4.6
None Local Low Not required Partial Partial Partial
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings.
153 CVE-2020-26892 798 2020-11-06 2022-01-01
7.5
None Remote Low Not required Partial Partial Partial
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
154 CVE-2020-26879 798 2020-10-26 2020-11-02
10.0
None Remote Low Not required Complete Complete Complete
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
155 CVE-2020-26509 798 DoS 2020-11-16 2020-11-30
5.0
None Remote Low Not required None None Partial
Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service.
156 CVE-2020-25752 798 2021-06-16 2021-06-24
5.0
None Remote Low Not required Partial None None
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static strings. The serial number can be retrieved by an unauthenticated user at /info.xml. These passwords can be easily calculated by an attacker; users are unable to change these passwords.
157 CVE-2020-25749 798 2020-09-25 2020-10-08
10.0
None Remote Low Not required Complete Complete Complete
The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet service cannot be disabled and this password cannot be changed via standard functionality.
158 CVE-2020-25688 798 +Info 2020-11-23 2020-12-08
2.7
None Local Network Low ??? Partial None None
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.
159 CVE-2020-25620 798 2020-12-16 2020-12-21
4.6
None Local Low Not required Partial Partial Partial
An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or the regular web interface.
160 CVE-2020-25565 798 Exec Code 2021-08-11 2021-08-17
7.5
None Remote Low Not required Partial Partial Partial
In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server.
161 CVE-2020-25561 798 2021-08-11 2021-08-16
4.6
None Local Low Not required Partial Partial Partial
SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client.
162 CVE-2020-25256 798 2020-09-11 2020-11-09
6.4
None Remote Low Not required Partial Partial None
An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI certificates have a private key that is the same across different customers' installations.
163 CVE-2020-25173 798 2021-01-26 2021-02-01
4.6
None Local Low Not required Partial Partial Partial
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access
164 CVE-2020-24876 798 2020-09-03 2020-09-10
5.0
None Remote Low Not required Partial None None
Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation.
165 CVE-2020-24620 798 2020-10-01 2021-02-12
2.1
None Local Low Not required Partial None None
Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reveal credentials.
166 CVE-2020-24574 798 Exec Code 2020-08-21 2021-09-27
6.9
None Local Medium Not required Complete Complete Complete
The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into GalaxyClient.exe, defeating the TCP-based "trusted client" protection mechanism.
167 CVE-2020-24218 798 2020-10-06 2020-10-19
5.0
None Remote Low Not required Partial None None
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard-coded in the executable file.
168 CVE-2020-24215 798 Exec Code 2020-10-06 2020-10-20
5.0
None Remote Low Not required Partial None None
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.
169 CVE-2020-24115 798 2020-08-31 2021-04-23
5.0
None Remote Low Not required Partial None None
In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
170 CVE-2020-21995 798 2021-04-29 2021-06-15
7.5
None Remote Low Not required Partial Partial Partial
Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system.
171 CVE-2020-16258 798 2020-10-28 2020-11-04
5.6
None Local Low Not required Partial None Complete
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
172 CVE-2020-16170 798 2020-08-11 2020-09-02
7.5
None Remote Low Not required Partial Partial Partial
Use of Hard-coded Credentials in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to listen in on any ongoing calls between temi robots and their users if they can brute-force/guess a six-digit value via unspecified vectors.
173 CVE-2020-15833 798 2021-02-01 2021-02-04
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to a public key that allows root access. This key is stored in a /rom location that cannot be modified by the device owner.
174 CVE-2020-15382 798 2021-06-09 2021-06-17
6.5
None Remote Low ??? Partial Partial Partial
Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at install-time.
175 CVE-2020-15324 798 2020-06-29 2020-07-06
7.5
None Remote Low Not required Partial Partial Partial
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.
176 CVE-2020-15323 798 2020-06-29 2020-07-06
7.5
None Remote Low Not required Partial Partial Partial
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
177 CVE-2020-15322 798 2020-06-29 2020-07-06
7.5
None Remote Low Not required Partial Partial Partial
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account.
178 CVE-2020-15321 798 2020-06-29 2020-07-06
7.5
None Remote Low Not required Partial Partial Partial
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.
179 CVE-2020-15320 798 2020-06-29 2020-07-02
7.5
None Remote Low Not required Partial Partial Partial
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.
180 CVE-2020-15319 798 2020-06-29 2020-07-02
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.
181 CVE-2020-15318 798 2020-06-29 2020-07-06
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.
182 CVE-2020-15317 798 2020-06-29 2020-07-06
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree.
183 CVE-2020-15316 798 2020-06-29 2020-07-06
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree.
184 CVE-2020-15315 798 2020-06-29 2020-07-06
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree.
185 CVE-2020-15314 798 2020-06-29 2020-07-02
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account.
186 CVE-2020-15313 798 2020-06-29 2020-07-02
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account.
187 CVE-2020-15312 798 2020-06-29 2020-07-02
4.3
None Remote Medium Not required Partial None None
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account.
188 CVE-2020-14510 798 Exec Code 2020-08-25 2021-11-04
10.0
None Remote Low Not required Complete Complete Complete
GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.
189 CVE-2020-14474 798 2020-06-30 2020-07-10
5.0
None Remote Low Not required Partial None None
The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.
190 CVE-2020-14099 798 2021-04-08 2021-04-14
5.0
None Remote Low Not required Partial None None
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.
191 CVE-2020-14070 798 Bypass 2020-06-29 2021-07-21
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executar_login.php result in admin access.
192 CVE-2020-13858 798 2021-02-01 2021-02-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations.
193 CVE-2020-13804 798 2020-06-04 2020-06-04
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plugin.
194 CVE-2020-13793 798 2020-08-06 2020-08-11
7.5
None Remote Low Not required Partial Partial Partial
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
195 CVE-2020-13414 798 2020-05-22 2021-12-01
5.0
None Remote Low Not required Partial None None
An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software.
196 CVE-2020-12789 798 2020-09-14 2020-09-18
4.3
None Remote Medium Not required Partial None None
The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
197 CVE-2020-12501 798 2020-10-15 2021-06-11
7.5
None Remote Low Not required Partial Partial Partial
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
198 CVE-2020-12376 798 2021-02-17 2021-02-22
2.1
None Local Low Not required Partial None None
Use of hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow authenticated user to potentially enable information disclosure via local access.
199 CVE-2020-12110 798 2020-05-04 2020-05-12
5.0
None Remote Low Not required Partial None None
Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.
200 CVE-2020-12047 798 2020-06-29 2020-07-08
7.5
None Remote Low Not required Partial Partial Partial
The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an FTP service with hard-coded credentials.
Total number of vulnerabilities : 680   Page : 1 2 3 4 (This Page)5 6 7 8 9 10 11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.