CWE-798 vulnerabilities

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52.

CVE-2026-27874 is a medium severity vulnerability in Johnson Controls EasyIO FS32 involving the use of hard-coded credentials. This flaw affects versions before 3.0b63 and allows exploitation of default or hard-coded credentials, potentially enabling unauthorized access. The vulnerability has a CVSS 4.0 score of 5.0, indicating a moderate risk. The product is a cloud service, and a patch is available to address this issue.

CVE-2026-55395 is a critical vulnerability in Teledyne FLIR Aware2 software versions up to 6.9.0.2 (PackBot) and 1.7.9 (FirstLook). It involves the use of hardcoded passwords in the access control mechanism, allowing remote unauthenticated attackers to access and reconfigure affected robots by extracting these credentials from firmware or documentation.

Joyland.ai contains hard-coded credentials for the GeTui push notification service. This vulnerability allows an attacker to use these credentials to access the GeTui REST API and send arbitrary push notifications to any user or group of users within the app. The issue affects all versions of Joyland.ai. The CVSS score is 6.5, indicating a medium severity vulnerability.

CVE-2026-13043 is a critical missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard Endpoint Security products. It allows a local, authenticated attacker to bypass the driver's access-control handshake and execute arbitrary privileged commands, leading to disclosure of kernel and process memory. The vulnerability affects versions prior to 8.00.26.0012. A fix is available in version 8.00.26.0012.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 contains hardcoded cloud-API credentials shared across devices. These credentials are embedded in the public firmware package, allowing unauthorized users to interact with the cloud service beyond intended operations. This vulnerability is identified as CWE-798 and has a high severity rating with a CVSS score of 7.5.

A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gain full root access to the device via the Telnet service (port 23) using static credentials.

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. This vulnerability allows an attacker with physical access or the firmware image to recover the root credentials and gain root access via the UART interface. The issue affects specific firmware versions and has a high severity rating.

The Eufy Omni C20 device contains a vulnerability due to the use of hard-coded credentials. This flaw could allow an attacker with local access to monitor log files and extract these credentials, potentially gaining unauthorized access to sensitive information such as mapping data. The vulnerability affects versions prior to 1.4.6. A fix is available in version 1.4.6.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

ZTE SmartLife application contains a hardcoded cryptographic key stored in plaintext within its code. This key is used to decrypt account server information. If an attacker obtains this key, they can decrypt sensitive server information, leading to exposure of confidential data. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS v3.1 score of 6.2, indicating a medium severity. No affected versions or patches have been explicitly stated.

IBM Guardium Data Protection version 12.2 contains a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. This flaw allows a low-privileged authenticated user to extract hardcoded product master secrets. Exploitation could lead to unauthorized access to the internal database and compromise of sensitive system information.

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.