CWE-798 · 1.577 kayıt
Gömülü kimlik bilgisi
Neden olur?
Destek ya da üretim kolaylığı için her cihazda aynı olan bir hesap yazılıma gömülüyor. Bir cihazdan öğrenilen bilgi, hepsinde geçerli olur.
Nasıl önlenir?
- 01Her cihaza üretimde benzersiz kimlik bilgisi atayın.
- 02İlk kurulumda parola değişimini zorunlu kılın.
- 03Yazılım paketlerini gömülü sırlar için otomatik tarayın.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
const SUPPORT_USER = "support";
const SUPPORT_PASS = "sabit-parola";Düzeltilmiş
const creds = await provisioning.deviceCredentials(deviceId);
if (creds.mustRotate) await forcePasswordChange(deviceId);Kodunuzda bu kalıp var mı?
Altyapı ve ağ sızma testi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
1.577 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
98Hemen | CVE-2022-26138Silahlaştırılmış | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users gatlassian · questions for confluence · CWE-798 | Kritik9,8 | KEV | %98,2 | 20 Tem 2022 |
98Hemen | CVE-2024-3272Silahlaştırılmış | D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsdlink · dns-320l firmware · CWE-798 | Kritik9,8 | KEV | %98,1 | 3 Nis 2024 |
97Hemen | CVE-2020-8657Silahlaştırılmış | An issue was discovered in EyesOfNetwork 5.3.eyesofnetwork · eyesofnetwork · CWE-798 | Kritik9,8 | KEV | %91,8 | 6 Şub 2020 |
94Hemen | CVE-2024-28987Silahlaştırılmış | SolarWinds Web Help Desk Hardcoded Credential Vulnerabilitysolarwinds · web help desk · CWE-798 | Kritik9,1 | KEV | %93,2 | 21 Ağu 2024 |
74Bu hafta | CVE-2025-14611Silahlaştırılmış | Gladinet CentreStack and TrioFox Hard Coded AES Keysgladinet · centrestack · CWE-798 | Yüksek7,1 | KEV | %54,5 | 12 Ara 2025 |
74Bu hafta | CVE-2026-22769Silahlaştırılmış | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.dell · recoverpoint for virtual machines · CWE-798 | Kritik10,0 | KEV | %13,5 | 17 Şub 2026 |
68Bu hafta | CVE-2019-15975Silahlaştırılmış | Cisco Data Center Network Manager Authentication Bypass Vulnerabilitiescisco · data center network manager · CWE-798 | Kritik9,8 | — | %96,4 | 6 Oca 2020 |
67Bu hafta | CVE-2019-15976Kavram kanıtı | Cisco Data Center Network Manager Authentication Bypass Vulnerabilitiescisco · data center network manager · CWE-798 | Kritik9,8 | — | %92,8 | 6 Oca 2020 |
67Bu hafta | CVE-2021-44207Silahlaştırılmış | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.acclaimsystems · usaherds · CWE-798 | Yüksek8,1 | KEV | %17,4 | 21 Ara 2021 |
64Bu hafta | CVE-2019-1935Silahlaştırılmış | Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerabilitycisco · integrated management controller supervisor · CWE-798 | Kritik9,8 | — | %83,3 | 21 Ağu 2019 |
62Bu hafta | CVE-2024-3408Silahlaştırılmış | Authentication Bypass and RCE in man-group/dtaleman · d-tale · CWE-798 | Kritik9,8 | — | %77,9 | 6 Haz 2024 |
62Bu hafta | CVE-2020-13166Silahlaştırılmış | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for allmylittletools · mylittleadmin · CWE-798 | Kritik9,8 | — | %77,6 | 19 May 2020 |
62Bu hafta | CVE-2017-14143Silahlaştırılmış | The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote atkaltura · kaltura server · CWE-798 | Kritik9,8 | — | %77,4 | 19 Eyl 2017 |
62Bu hafta | CVE-2022-1162Kavram kanıtı | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.gitlab · gitlab · CWE-798 | Kritik9,8 | — | %75,6 | 4 Nis 2022 |
61Bu hafta | CVE-2020-11854Silahlaştırılmış | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.microfocus · application performance management · CWE-798 | Kritik9,8 | — | %74,4 | 27 Eki 2020 |
61Bu hafta | CVE-2016-1560Silahlaştırılmış | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for theexagrid · ex3000 firmware · CWE-798 | Kritik9,8 | — | %72,2 | 21 Nis 2017 |
61Bu hafta | CVE-2020-4429Silahlaştırılmış | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.ibm · data risk manager · CWE-798 | Kritik9,8 | — | %71,9 | 7 May 2020 |
60Bu hafta | CVE-2023-22463Kavram kanıtı | KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT tokenfit2cloud · kubepi · CWE-798 | Kritik9,8 | — | %69,6 | 4 Oca 2023 |
60Bu hafta | CVE-2023-5074Kavram kanıtı | Authentication Bypass in D-Link D-View 8dlink · d-view 8 · CWE-798 | Kritik9,8 | — | %69,0 | 20 Eyl 2023 |
60Bu hafta | CVE-2014-9614Kavram kanıtı | The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attacnetsweeper · netsweeper · CWE-798 | Kritik9,8 | — | %68,7 | 19 Şub 2020 |
60Bu hafta | CVE-2023-28503Silahlaştırılmış | Authentication bypass in UniRPC's udadmin servicerocketsoftware · unidata · CWE-798 | Kritik9,8 | — | %60,6 | 29 Mar 2023 |
60Bu hafta | CVE-2018-15439Silahlaştırılmış | Cisco Small Business Switches Privileged Access Vulnerabilitycisco · sg200-50 firmware · CWE-798 | Kritik9,8 | — | %49,7 | 8 Kas 2018 |
60Bu hafta | CVE-2018-16158Silahlaştırılmış | Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installationeaton · power xpert meter 4000 firmware · CWE-798 | Kritik9,8 | — | %30,3 | 30 Ağu 2018 |
60Bu hafta | CVE-2019-19492Silahlaştırılmış | FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.freeswitch · freeswitch · CWE-798 | Kritik9,8 | — | %29,4 | 1 Ara 2019 |
60Bu hafta | CVE-2017-18371Silahlaştırılmış | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two zyxel · p660hn-t1a v2 firmware · CWE-798 | Kritik9,8 | — | %22,5 | 2 May 2019 |
- CVE-2022-2613898Hemen
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98atlassian · questions for confluence20 Tem 2022
- CVE-2024-327298Hemen
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98dlink · dns-320l firmware3 Nis 2024
- CVE-2020-865797Hemen
An issue was discovered in EyesOfNetwork 5.3.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91eyesofnetwork · eyesofnetwork6 Şub 2020
- CVE-2024-2898794Hemen
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
KritikCVSS 9,1KEVSilahlaştırılmışEPSS %93solarwinds · web help desk21 Ağu 2024
- CVE-2025-1461174Bu hafta
Gladinet CentreStack and TrioFox Hard Coded AES Keys
YüksekCVSS 7,1KEVSilahlaştırılmışEPSS %54gladinet · centrestack12 Ara 2025
- CVE-2026-2276974Bu hafta
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %13dell · recoverpoint for virtual machines17 Şub 2026
- CVE-2019-1597568Bu hafta
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
KritikCVSS 9,8SilahlaştırılmışEPSS %96cisco · data center network manager6 Oca 2020
- CVE-2019-1597667Bu hafta
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
KritikCVSS 9,8Kavram kanıtıEPSS %92cisco · data center network manager6 Oca 2020
- CVE-2021-4420767Bu hafta
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %17acclaimsystems · usaherds21 Ara 2021
- CVE-2019-193564Bu hafta
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
KritikCVSS 9,8SilahlaştırılmışEPSS %83cisco · integrated management controller supervisor21 Ağu 2019
- CVE-2024-340862Bu hafta
Authentication Bypass and RCE in man-group/dtale
KritikCVSS 9,8SilahlaştırılmışEPSS %77man · d-tale6 Haz 2024
- CVE-2020-1316662Bu hafta
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all
KritikCVSS 9,8SilahlaştırılmışEPSS %77mylittletools · mylittleadmin19 May 2020
- CVE-2017-1414362Bu hafta
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote at
KritikCVSS 9,8SilahlaştırılmışEPSS %77kaltura · kaltura server19 Eyl 2017
- CVE-2022-116262Bu hafta
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.
KritikCVSS 9,8Kavram kanıtıEPSS %75gitlab · gitlab4 Nis 2022
- CVE-2020-1185461Bu hafta
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.
KritikCVSS 9,8SilahlaştırılmışEPSS %74microfocus · application performance management27 Eki 2020
- CVE-2016-156061Bu hafta
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the
KritikCVSS 9,8SilahlaştırılmışEPSS %72exagrid · ex3000 firmware21 Nis 2017
- CVE-2020-442961Bu hafta
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.
KritikCVSS 9,8SilahlaştırılmışEPSS %71ibm · data risk manager7 May 2020
- CVE-2023-2246360Bu hafta
KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
KritikCVSS 9,8Kavram kanıtıEPSS %69fit2cloud · kubepi4 Oca 2023
- CVE-2023-507460Bu hafta
Authentication Bypass in D-Link D-View 8
KritikCVSS 9,8Kavram kanıtıEPSS %69dlink · d-view 820 Eyl 2023
- CVE-2014-961460Bu hafta
The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attac
KritikCVSS 9,8Kavram kanıtıEPSS %68netsweeper · netsweeper19 Şub 2020
- CVE-2023-2850360Bu hafta
Authentication bypass in UniRPC's udadmin service
KritikCVSS 9,8SilahlaştırılmışEPSS %60rocketsoftware · unidata29 Mar 2023
- CVE-2018-1543960Bu hafta
Cisco Small Business Switches Privileged Access Vulnerability
KritikCVSS 9,8SilahlaştırılmışEPSS %49cisco · sg200-50 firmware8 Kas 2018
- CVE-2018-1615860Bu hafta
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation
KritikCVSS 9,8SilahlaştırılmışEPSS %30eaton · power xpert meter 4000 firmware30 Ağu 2018
- CVE-2019-1949260Bu hafta
FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
KritikCVSS 9,8SilahlaştırılmışEPSS %29freeswitch · freeswitch1 Ara 2019
- CVE-2017-1837160Bu hafta
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two
KritikCVSS 9,8SilahlaştırılmışEPSS %22zyxel · p660hn-t1a v2 firmware2 May 2019