CWE:

	Topic	Date	Author
High	SAP Wily Introscope Enterprise Default Hard-Coded Credentials	15.06.2021	Yvan Genuer
Med.	CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed	27.05.2021	Jim Becher
High	Barco wePresent Global Hardcoded Root SSH Password	21.11.2020	Jim Becher
Med.	Barco wePresent Hardcoded API Credentials	21.11.2020	Jim Becher
High	Heatmiser Netmonitor 3.03 Hardcoded Credentials	31.12.2019	Ismail Tasdelen
Med.	Fortinet FortiRecorder 2.7.3 Hardcoded Password	08.08.2019	XORcat
High	HPE VAN SDN 2.7.18.0503 Remote Root	28.06.2018	KoreLogic
High	HP Enterprise VAN SDN Controller 2.7.18.0503 Remote Root	27.06.2018	Matthew Bergin
High	Solarwinds LEM 6.3.1 Hardcoded Credentials	25.04.2017	Matt Bergin
High	Cisco Firepower Threat Management Console Hard-Coded MySQL Credentials	06.10.2016	Matt Bergin
High	AVer Information EH6108H+ Authentication Bypass / Inforation Exposure	28.09.2016	Multiple
High	Seagate GoFlex Satellite Remote Telnet Default Password	19.12.2015	Matt Bergin
High	ZTE ZXHN H108N R1A / ZXV10 W300 Traversal / Disclosure / Authorization	21.11.2015	Karn Ganeshen
High	SAP NetWeaver AS FKCDBFTRACE ABAP Hardcoded Credentials	10.09.2015	Rustem Gazizov, Diana ...
High	SAP NetWeaver AS LSCT1I13 ABAP Hardcoded Credentials	10.09.2015	Rustem Gazizov, Diana ...
High	AirLink101 SkyIPCam1620W OS Command Injection	09.07.2015	CORE
Low	SAP FI Manager Self-Service Hardcoded Username	30.07.2014	Onapsis
Med.	SAP Hard-Coded Credentials	07.06.2014	Ezequiel Gutesman
High	ZTE ZXV10 W300 router contains hardcoded credentials	09.02.2014	USCERT
Med.	Franklin Fuelings T550 Evo Access Control / Credentials	22.01.2014	Matt Jakubowski
High	TP-Link IP Cameras multiple vulnerabilities	28.05.2013	CORE
High	Zavio IP Cameras multiple vulnerabilities	28.05.2013	CORE
High	D-Link IP Cameras Injection & Bypass	30.04.2013	CORE

---

CVEMAP Search Results

CVE

Details

Description

2023-09-07

	CVE-2023-39420	Updating...	The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.
	CVE-2023-39421	Updating...	The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
	CVE-2023-39422	Updating...	The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.

2023-08-28

	CVE-2023-38024	Updating...
	CVE-2023-38026	Updating...	SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.

2023-08-23

CVE-2022-3744

Updating...

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.

2023-08-09

	CVE-2023-37857	Updating...	In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. This issue cannot be exploited to bypass the web service authentication of the affected device(s).
	CVE-2023-37858	Updating...	In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing to decrypt an encrypted web application login password.

2023-07-21

CVE-2023-37291

Updating...

Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data. This issue affects Vitals ESP: from 3.0.8 through 6.2.0.

2023-07-10

CVE-2023-37287

Updating...

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.

 

---

Copyright 2023, cxsecurity.com