CWE-798 vulnerabilities

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.

Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

The CP Plus CP-XR-DE21-S Router contains a vulnerability due to hardcoded HTTP Digest authentication credentials in its firmware. These credentials are identical across all affected devices, allowing an attacker with local network access to potentially gain unauthorized administrative control. This vulnerability can lead to privileged operations being performed on the device without proper authorization.

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

The Bendix EC80ESP+ J1708 Brake ECU contains hard-coded credentials that could allow an attacker to disable the automatic traction control feature. This vulnerability is identified as CWE-798 and has a CVSS score of 5.4, indicating a medium severity. No patch or official remediation has been documented yet. The vulnerability does not impact confidentiality but could affect system integrity and availability by disabling a safety feature.

CVE-2026-59270 is a critical vulnerability in Spring Security involving the embedded UnboundID LDAP server (UnboundIdContainer). It unconditionally registers an administrative credential and binds its listener to all network interfaces, potentially allowing unauthorized access. This affects multiple versions of Spring Security including 5.7.0, 5.8.0, 6.4.0, 6.5.0, 7.0.0, and 7.1.0. The vulnerability has a high CVSS score of 9.4, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-75896 is a critical vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Liderahenk product prior to version 3.5.5. It involves the use of hard-coded credentials, allowing attackers to use common or default usernames and passwords to gain unauthorized access. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-12587 is a high-severity vulnerability in Resamania Virtuagym involving the use of hard-coded credentials. The application uses a static 'badge_number' as an HMAC private key for generating physical access QR codes. This value is accessible via an API endpoint and can be extracted from the APK due to lack of code obfuscation. An attacker with access to this key and the cryptographic logic can generate valid QR codes indefinitely, bypassing password changes or logouts.

DJI drones contain an FTP service with hardcoded credentials that allow authenticated users to upload unlimited files to the /blackbox/upgrade/ directory, including overwriting existing files. This can lead to exhaustion of storage, preventing the drone from recording flight data and potentially blocking firmware updates. The vulnerability affects multiple DJI drone models with firmware versions prior to specified updates. Remediation requires a firmware update from DJI.

CVE-2026-50601 is a medium severity vulnerability in the Acer Planet9 desktop application version 2.6.131. It involves the use of a hardcoded read-only API key that allows unauthorized access to internal repositories. Exploiting this flaw could enable an attacker to extract embedded administrative keys and secrets, potentially gaining administrative access to repository infrastructure and modifying software source code. Acer has released an update to address this issue, though explicit patch details are not provided.

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

CVE-2026-18164 is a vulnerability in the Flow Neuroscience FL-100 device involving an undocumented hard-coded credential shared by all units. This credential allows an attacker within Bluetooth range to bypass authentication and manipulate brain stimulation parameters and device state arbitrarily. The vulnerability has a high severity score of 7.2 and does not currently have an official patch or remediation guidance available.