CWE-798 · Authentication
Hard-coded Credentials
1,594CVEs
9exploited
23with a public check
72likely (EPSS 10%+)
SortMost likely exploited
1,594 CVEs with CWE-798 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-26138In CISA KEVExploitedAtlassian Questions For Confluence - Hardcoded CredentialsAtlassian · Questions For Confluence · CVSS 9.8 · 2022-07-20 | 9.8 | 98% | 2022-07-20 |
| CVE-2024-3272In CISA KEVExploitedD-Link Network Attached Storage - Backdoor AccountD-Link · DNS-320L · CVSS 9.8 · 2024-04-04 | 9.8 | 98% | 2024-04-04 |
| CVE-2024-28987In CISA KEVExploitedSolarWinds Web Help Desk - Hardcoded CredentialSolarWinds · Web Help Desk · CVSS 9.1 · 2024-08-21 | 9.1 | 93% | 2024-08-21 |
| CVE-2020-8657In CISA KEVExploitedEyesOfNetwork - Hardcoded API KeyEyesOfNetwork · EyesOfNetwork · CVSS 9.8 · 2020-02-06 | 9.8 | 92% | 2020-02-06 |
| CVE-2022-28810In CISA KEVExploitedZoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom scrip…Zoho · ManageEngine · CVSS 6.8 · 2022-04-18 | 6.8 | 71% | 2022-04-18 |
| CVE-2025-14611In CISA KEVExploitedGladinet CentreStack & Triofox - Hardcoded CredentialsGladinet · CentreStack and TrioFox · CVSS 7.1 · 2025-12-12 | 7.1 | 55% | 2025-12-12 |
| CVE-2021-44207In CISA KEVExploitedAcclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.Acclaim Systems · USAHERDS · CVSS 8.1 · 2021-12-21 | 8.1 | 17% | 2021-12-21 |
| CVE-2026-22769In CISA KEVExploitedDell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attac…Dell · RecoverPoint for Virtual Machines · CVSS 10 · 2026-02-17 | 10.0 | 13% | 2026-02-17 |
| CVE-2019-6693In CISA KEVExploitedUse of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive…Fortinet · FortiGate · CVSS 6.5 · 2019-11-21 | 6.5 | 6.6% | 2019-11-21 |
| CVE-2024-3408CheckD-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Executionman-group · man-group/dtale · CVSS 9.8 · 2024-06-06 | 9.8 | 78% | 2024-06-06 |
| CVE-2022-1162CheckGitLab CE/EE - Hard-Coded CredentialsGitLab · GitLab · CVSS 9.1 · 2022-04-04 | 9.1 | 76% | 2022-04-04 |
| CVE-2020-11854CheckMicro Focus UCMDB - Remote Code ExecutionMicro Focus · Application Performance Management · CVSS 9.8 · 2020-10-27 | 9.8 | 74% | 2020-10-27 |
| CVE-2020-4429CheckIBM Data Risk Manager - Hardcoded CredentialsIBM · Data Risk Manager · CVSS 10 · 2020-05-07 | 10.0 | 72% | 2020-05-07 |
| CVE-2023-22463CheckKubePi JwtSigKey - Admin Authentication BypassKubeOperator · KubePi · CVSS 9.8 · 2023-01-04 | 9.8 | 70% | 2023-01-04 |
| CVE-2023-5074CheckD-Link D-View 8 v2.0.1.28 - Authentication BypassD-Link · D-View 8 · CVSS 9.8 · 2023-09-20 | 9.8 | 69% | 2023-09-20 |
| CVE-2014-9614CheckNetsweeper 4.0.5 - Default Weak AccountNetsweeper · Netsweeper · 2020-02-19 | – | 69% | 2020-02-19 |
| CVE-2019-19492CheckFreeSWITCH Event Socket - Default Credentials (ClueCon)Freeswitch · Freeswitch · 2019-12-02 | – | 65% | 2019-12-02 |
| CVE-2021-22707CheckEVlink City < R8 V3.4.0.1 - Authentication BypassSchneider-Electric · EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Pa… · 2021-07-21 | – | 65% | 2021-07-21 |
| CVE-2018-9161CheckPrismaWEB - Credentials DisclosurePrismaindustriale · Checkweigher Prismaweb · 2018-03-31 | – | 57% | 2018-03-31 |
| CVE-2025-34509CheckSitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded CredentialsSitecore · Experience Manager · CVSS 7.5 · 2025-06-17 | 7.5 | 56% | 2025-06-17 |
| CVE-2019-16313Checkifw8 Router ROM v4.31 - Credential DiscoveryIfw8 · Fr6 Firmware · 2019-09-14 | – | 46% | 2019-09-14 |
| CVE-2020-26879CheckRuckus vRioT IoT Controller - Authentication BypassCommscope · Ruckus Vriot · 2020-10-26 | – | 44% | 2020-10-26 |
| CVE-2025-20188CheckCisco IOS XE WLC - Arbitrary File UploadCisco · Cisco IOS XE Software · CVSS 10 · 2025-05-07 | 10.0 | 28% | 2025-05-07 |
| CVE-2022-35413CheckWAPPLES Web Application Firewall <=6.0 - Hardcoded CredentialsPentasecurity · Wapples · 2022-09-13 | – | 19% | 2022-09-13 |
| CVE-2020-35338CheckWireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential DetectionMobileviewpoint · Wireless Multiplex Terminal Playout Server · 2020-12-14 | – | 12% | 2020-12-14 |
| CVE-2022-31269CheckLinear eMerge E3-Series - Information DisclosureNortekcontrol · Emerge E3 Firmware · 2022-08-25 | – | 7.6% | 2022-08-25 |
| CVE-2026-44825CheckApache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default CredentialsApache Software Foundation · Apache Solr · CVSS 8.1 · 2026-06-01 | 8.1 | 3.9% | 2026-06-01 |
| CVE-2023-38433CheckFujitsu IP Series - Hardcoded CredentialsFujitsu Limited · IP-HE950E · 2023-07-26 | – | 3.7% | 2023-07-26 |
| CVE-2022-34045CheckWAVLINK WN530HG4 - Improper Access ControlWavlink · Wl-Wn530hg4 Firmware · 2022-07-20 | – | 3.4% | 2022-07-20 |
| CVE-2026-56265CheckCrawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication BypassCrawl4AI · Crawl4AI · CVSS 9.8 · 2026-06-21 | 9.8 | 2.6% | 2026-06-21 |
| CVE-2025-69971CheckFUXA <= 1.2.7 - Hardcoded JWT Secret Authentication BypassFrangoteam · Fuxa · CVSS 9.8 · 2026-02-03 | 9.8 | 2.2% | 2026-02-03 |
| CVE-2025-25570CheckVue Vben Admin - Default CredentialsNo vendor recorded · CVSS 9.8 · 2025-02-27 | 9.8 | 2.1% | 2025-02-27 |
| CVE-2019-15975Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco · Cisco Data Center Network Manager · CVSS 9.8 · 2020-01-06 | 9.8 | 96% | 2020-01-06 |
| CVE-2019-15976Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco · Cisco Data Center Network Manager · CVSS 9.8 · 2020-01-06 | 9.8 | 93% | 2020-01-06 |
| CVE-2019-1935Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials VulnerabilityCisco · Cisco Unified Computing System Director · CVSS 9.8 · 2019-08-21 | 9.8 | 83% | 2019-08-21 |
| CVE-2020-13166The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.confi…Mylittletools · Mylittleadmin · 2020-05-19 | – | 78% | 2020-05-19 |
| CVE-2017-14143The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protectio…Kaltura · Kaltura Server · 2017-09-19 | – | 77% | 2017-09-19 |
| CVE-2016-1560ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface,…Exagrid · Ex3000 Firmware · 2017-04-21 | – | 72% | 2017-04-21 |
| CVE-2023-28503Authentication bypass in UniRPC's udadmin serviceRocket Software · UniData · CVSS 9.8 · 2023-03-29 | 9.8 | 61% | 2023-03-29 |
| CVE-2018-15439Cisco Small Business Switches Privileged Access VulnerabilityCisco · Cisco Small Business 300 Series Managed Switches · CVSS 9.8 · 2018-11-08 | 9.8 | 50% | 2018-11-08 |
| CVE-2022-38420Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-serviceAdobe · ColdFusion · CVSS 7.5 · 2022-10-14 | 7.5 | 45% | 2022-10-14 |
| CVE-2016-5645Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it…Rockwellautomation · 1766-L32awa · CVSS 7.3 · 2016-08-24 | 7.3 | 38% | 2016-08-24 |
| CVE-2019-15977Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco · Cisco Data Center Network Manager · CVSS 9.8 · 2020-01-06 | 9.8 | 38% | 2020-01-06 |
| CVE-2018-11094An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authe…Intelbras · Ncloud 300 Firmware · 2018-05-15 | – | 33% | 2018-05-15 |
| CVE-2025-68926RustFS has a gRPC Hardcoded Token Authentication Bypassrustfs · rustfs · CVSS 9.8 · 2025-12-30 | 9.8 | 32% | 2025-12-30 |
| CVE-2018-16158Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access t…Eaton · Power Xpert Meter 4000 Firmware · 2018-08-30 | – | 30% | 2018-08-30 |
| CVE-2021-27162An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.Fiberhome · Hg6245d Firmware · 2021-02-10 | – | 28% | 2021-02-10 |
| CVE-2017-6403An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and password.Veritas · Netbackup · 2017-03-02 | – | 27% | 2017-03-02 |
| CVE-2021-27164An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.Fiberhome · Hg6245d Firmware · 2021-02-10 | – | 24% | 2021-02-10 |
| CVE-2021-27158An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.Fiberhome · Hg6245d Firmware · 2021-02-10 | – | 24% | 2021-02-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.