IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the adminis

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm qradar incident forensics7.2.0 and later · before 7.2.8
• ibm qradar incident forensics7.3.0 and later · before 7.3.1
• ibm qradar incident forensics7.2.8
• ibm qradar incident forensics7.3.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM QRadar SIEM

  • 7.2, 7.3affected

Other highest-scoring records for the same primary product.

• CVE-2016-9726IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.
  36Monitor
• CVE-2016-9727IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.
  35Monitor
• CVE-2025-33120IBM QRadar SIEM privilege escalation
  31Monitor
• CVE-2018-1648IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info
  30Monitor
• CVE-2018-1647IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthen
  30Monitor
• CVE-2017-1622IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrectly validates, a certificate.
  29Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

For convenience in support or manufacturing, an account that is identical on every device is embedded in the software. Credentials learned from one device work on all of them.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const SUPPORT_USER = "support";2const SUPPORT_PASS = "hardcoded-password";

1const creds = await provisioning.deviceCredentials(deviceId);2if (creds.mustRotate) await forcePasswordChange(deviceId);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.