CWE-259 · Authentication
Use of Hard-coded Password
229CVEs
SortMost likely exploited
229 CVEs with CWE-259 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-20316In CISA KEVExploitedCisco Secure Firewall Management Center Software Static Credential VulnerabilityCisco · Cisco Secure Firewall Management Center (FMC) · CVSS 5.3 · 2026-07-29 | 5.3 | 35% | 2026-07-29 |
| CVE-2023-5222CheckViessmann Vitogate 300 - Hardcoded PasswordViessmann · Vitogate 300 · CVSS 6.3 · 2023-09-27 | 6.3 | 80% | 2023-09-27 |
| CVE-2024-7332CheckTOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password VulnerabilityTOTOLINK · CP450 · CVSS 9.8 · 2024-08-01 | 9.8 | 21% | 2024-08-01 |
| CVE-2025-57788CheckCommvault Unauthenticated Password Disclosure (WT-2025-0047)Commvault · CommCell · CVSS 6.9 · 2025-08-20 | 6.9 | 7.8% | 2025-08-20 |
| CVE-2026-19900CheckLB-LINK Routers - Unauthenticated Command InjectionLB-LINK · X-PRO · CVSS 8.1 · 2026-08-15 | 8.1 | 2.9% | 2026-08-15 |
| CVE-2012-5862Sinapsi eSolar Hard-Coded PasswordSinapsi · eSolar · CVSS 10 · 2012-11-23 | 10.0 | 12% | 2012-11-23 |
| CVE-2025-8730Belkin F9K1009/F9K1010 Web Interface hard-coded credentialsBelkin · F9K1009 · CVSS 9.8 · 2025-08-08 | 9.8 | 4.0% | 2025-08-08 |
| CVE-2023-51629D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass VulnerabilityD-Link · DCS-8300LHV2 · CVSS 6.3 · 2024-05-03 | 6.3 | 3.9% | 2024-05-03 |
| CVE-2023-2645USR USR-G806 Web Management Page hard-coded passwordUSR · USR-G806 · CVSS 9.8 · 2023-05-11 | 9.8 | 3.2% | 2023-05-11 |
| CVE-2014-5405Hospira MedNet Use of Hard-coded PasswordHospira · MedNet · CVSS 9 · 2015-04-03 | 9.0 | 2.3% | 2015-04-03 |
| CVE-2016-9358A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530,…Marel · Marel Food Processing Systems · 2017-06-30 | – | 2.1% | 2017-06-30 |
| CVE-2014-2363Morpho Itemiser 3 Hard-Coded CredentialMorpho · Itemiser 3 · CVSS 10 · 2014-07-26 | 10.0 | 2.1% | 2014-07-26 |
| CVE-2015-3953Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, vers…Hospira · Plum A+ Infusion System · 2019-03-25 | – | 2.0% | 2019-03-25 |
| CVE-2020-12016Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10…Baxter · Baxter ExactaMix EM 2400 & EM 1200 · 2020-06-29 | – | 1.9% | 2020-06-29 |
| CVE-2021-22729A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions…Schneider-Electric · EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Pa… · 2021-07-21 | – | 1.8% | 2021-07-21 |
| CVE-2019-3908Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups ca…Identicard · Premisys Identicard 3.1.190 · 2019-01-18 | – | 1.8% | 2019-01-18 |
| CVE-2017-6022A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior v…Bd · BD Kiestra PerformA and KLA Journal Service · 2017-06-30 | – | 1.8% | 2017-06-30 |
| CVE-2021-32525QSAN Storage Manager - Use of Hard-coded Password-2QSAN · Storage Manager · CVSS 9.1 · 2021-07-07 | 9.1 | 1.7% | 2021-07-07 |
| CVE-2021-21818A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to a denial of se…Dlink · D-Link · CVSS 7.5 · 2021-07-16 | 7.5 | 1.7% | 2021-07-16 |
| CVE-2020-12047The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an F…Baxter · Baxter Sigma Spectrum Infusion Pumps · 2020-06-29 | – | 1.7% | 2020-06-29 |
| CVE-2020-12045The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), operates a Telnet service on Port 1023 wi…Baxter · Baxter Sigma Spectrum Infusion Pumps · 2020-06-29 | – | 1.7% | 2020-06-29 |
| CVE-2014-5434Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credentials used with the F…Baxter · SIGMA Spectrum Infusion System · 2019-03-26 | – | 1.6% | 2019-03-26 |
| CVE-2022-29831Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information…Mitsubishi Electric Corporation · GX Works3 · CVSS 7.5 · 2022-11-24 | 7.5 | 1.4% | 2022-11-24 |
| CVE-2021-27440The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versio…Ge · Reason DR60 · 2021-03-25 | – | 1.4% | 2021-03-25 |
| CVE-2020-2499Hard-coded Password Vulnerability in QESQNAP Systems Inc. · QES · CVSS 6.3 · 2020-12-24 | 6.3 | 1.4% | 2020-12-24 |
| CVE-2019-13530Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part…Philips · Philips IntelliVue WLAN, portable patient monitors · 2019-09-12 | – | 1.4% | 2019-09-12 |
| CVE-2024-8580TOTOLINK AC1200 T8 shadow.sample hard-coded passwordTOTOLINK · AC1200 T8 · CVSS 8.1 · 2024-09-08 | 8.1 | 1.3% | 2024-09-08 |
| CVE-2025-6932D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded passwordD-Link · DCS-7517 · CVSS 3.7 · 2025-06-30 | 3.7 | 1.3% | 2025-06-30 |
| CVE-2017-20039SICUNET Access Controller hard-coded passwordSICUNET · Access Controller · CVSS 9.8 · 2022-06-11 | 9.8 | 1.3% | 2022-06-11 |
| CVE-2026-2616Beetel 777VR1 Web Management hard-coded credentialsBeetel · 777VR1 · CVSS 8.8 · 2026-02-17 | 8.8 | 1.2% | 2026-02-17 |
| CVE-2024-26196Microsoft Edge for Android (Chromium-based) Information Disclosure VulnerabilityMicrosoft · Microsoft Edge for Android · CVSS 4.3 · 2024-02-29 | 4.3 | 1.2% | 2024-02-29 |
| CVE-2021-38456Moxa MXview Network Management SoftwareMoxa · MXview Network Management Software · CVSS 9.8 · 2021-10-12 | 9.8 | 1.2% | 2021-10-12 |
| CVE-2017-6039A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access…Phoenixbroadband · Phoenix Broadband Technologies LLC PowerAgent SC3 Site Controller · 2017-06-02 | – | 1.2% | 2017-06-02 |
| CVE-2025-20286ISE on AWS Static CredentialCisco · Cisco Identity Services Engine Software · CVSS 9.9 · 2025-06-04 | 9.9 | 1.2% | 2025-06-04 |
| CVE-2021-28813Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchQNAP Systems Inc. · QSW-M2116P-2T2S · CVSS 9.6 · 2021-09-10 | 9.6 | 1.1% | 2021-09-10 |
| CVE-2019-10881Default hidden Privileged Account Vulnerability in multiple XEROX devicesXEROX · AltaLink B8045/B8055/B8065/B8075/B8090 · CVSS 9.4 · 2021-04-13 | 9.4 | 1.1% | 2021-04-13 |
| CVE-2022-27172A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request can lead to privilege…InHand Networks · InRouter302 · CVSS 4.3 · 2022-05-12 | 4.3 | 1.1% | 2022-05-12 |
| CVE-2021-34601Bender Charge Controller: Hardcoded Credentials in Charge ControllerBender / ebee · CC612 · CVSS 9.8 · 2022-04-27 | 9.8 | 1.1% | 2022-04-27 |
| CVE-2021-36312Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may…Dell · CloudLink · CVSS 9.1 · 2021-11-23 | 9.1 | 1.1% | 2021-11-23 |
| CVE-2020-5351Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthen…Dell · Data Protection Advisor · CVSS 7.5 · 2021-07-28 | 7.5 | 1.1% | 2021-07-28 |
| CVE-2022-30271The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no priv…Motorola · Ace1000 Firmware · CVSS 9.8 · 2022-07-26 | 9.8 | 1.1% | 2022-07-26 |
| CVE-2022-22144A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During system startup this fun…TCL · LinkHub Mesh Wifi · CVSS 7.5 · 2022-08-05 | 7.5 | 1.0% | 2022-08-05 |
| CVE-2023-46685A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead…LevelOne · WBR-6013 · CVSS 9.8 · 2024-07-08 | 9.8 | 1.0% | 2024-07-08 |
| CVE-2024-4708mySCADA myPRO Use of Hard-coded PasswordmySCADA · myPRO · CVSS 9.8 · 2024-07-02 | 9.8 | 1.0% | 2024-07-02 |
| CVE-2014-125030taoeffect Empress hard-coded passwordtaoeffect · Empress · CVSS 6.3 · 2023-01-01 | 6.3 | 1.0% | 2023-01-01 |
| CVE-2022-45444CVE-2022-45444Sewio · RTLS Studio · CVSS 10 · 2023-01-18 | 10.0 | 0.9% | 2023-01-18 |
| CVE-2018-25069Netis Netcore Router hard-coded passwordNetis · Netcore Router · CVSS 7.3 · 2023-01-07 | 7.3 | 0.9% | 2023-01-07 |
| CVE-2023-3237OTCMS hard-coded passwordOtcms · OTCMS · CVSS 6.3 · 2023-06-14 | 6.3 | 0.9% | 2023-06-14 |
| CVE-2023-32145D-Link DAP-1360 Hardcoded Credentials Authentication Bypass VulnerabilityD-Link · DAP-1360 · CVSS 8.8 · 2024-05-03 | 8.8 | 0.9% | 2024-05-03 |
| CVE-2025-27638Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.Printerlogic · Vasion Print · CVSS 9.8 · 2025-03-05 | 9.8 | 0.9% | 2025-03-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.