The
iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.
Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.
A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials.
A separate path traversal vulnerability in the same download endpoint allows the configured storage root to be escaped, enabling reads of arbitrary files on the server filesystem. Combined, these issues allow an unauthenticated attacker to obtain sensitive server configuration and key material, which can lead to full server compromise. The vulnerability can be chained with CVE-2026-9152 to enumerate and bulk-download stored content. Altium 365 cloud deployments are not impacted in practice, as file storage uses object storage rather than the local filesystem.
NAVTOR NavBox versions up to and including 4.16.1.20 contain hard-coded credentials in their Windows Communication Foundation (SOAP) implementation. If SOAP functionality is enabled, a local attacker can extract these credentials to bypass intended transfer workflows. Successful authentication via the SOAP interface allows access to privileged methods that can write or overwrite files within application-defined paths. This vulnerability has a medium severity rating with a CVSS score of 5.8.
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.
CVE-2026-49204 is a medium severity vulnerability in the Acer Connect M6E 5G Portable WiFi Router involving leftover debug modules that contain hard-coded credentials for internal AWS Cognito test sandboxes. This exposure risks unauthorized access to internal assets. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low attack complexity and no required privileges or user interaction. The affected product is a cloud service, and a patch is available, with the vendor managing remediation for the cloud-hosted service.
Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update.
This issue affects KS-SOMED with modules: KSPLUPDFTP.exe up to 30.00.00.056 and ANEKSKLIENT.EXE up to 29.00.02.026
Beside removing the hard-coded credentials from the code and changing the update process, access granted by previously exposed credentials was limited to read-only.
The PDBM application relies on a static, hard‑coded secret embedded
in the PDBM.exe executable. This secret is used by the application’s
encryption routines, including the function responsible for decrypting
credentials stored in the product’s configuration file. Because the
secret is constant across installations, any attacker with sufficient
local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored
password and authenticate as the user defined in the configuration file.
In the affected version, this user account is configured with
administrative privileges, granting full access to PDBM’s management
interface and its underlying operational functions.
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account.
As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.
The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.
Not affected:
* Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
* Clusters where template users have been assigned strong passwords after bootstrap
The Danelec MacGregor Voyage Data Recorder (VDR) G4e contains default accounts with hard-coded credentials. This vulnerability allows unauthorized access without requiring user interaction or privileges. The issue is classified under CWE-798, indicating the use of hard-coded credentials. The CVSS score of 8.3 reflects a high severity with significant confidentiality and integrity impact and a low impact on availability. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.
The USR-W610 RS232/485 to Wi-Fi/Ethernet Converter from Jinan USR IOT Technology Limited contains plaintext administrative credentials embedded in its firmware. These credentials can be extracted by analyzing the firmware image, allowing unauthorized authentication to device services. This vulnerability is classified as CWE-798 and has a critical severity with a CVSS score of 9.8. No official patch or remediation guidance is currently available from the vendor. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the device.
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM immobilizer secret by passively observing a single seed/key exchange. The WCM derives its response using a reversible, non-cryptographic operation rather than a cryptographic challenge-response, so the persistent immobilizer secret can be reconstructed from one captured exchange. With this secret the attacker can authenticate to the ECM independently of the WCM and start the engine, defeating the immobilizer. Specific protocol details have been withheld pending vendor remediation.
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device.
Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server.
This issue has been fixed in version 2026.4
CVE-2026-33893 is a high-severity vulnerability in Siemens Teamcenter versions prior to certain patch levels across multiple releases. The issue involves hardcoded cryptographic keys embedded in the application for obfuscation purposes. An attacker who obtains these keys could misuse them to gain unauthorized access. There is no official patch or remediation level currently indicated by the vendor. The vulnerability has a CVSS score of 7.5, reflecting its network exploitable nature and high confidentiality impact without requiring privileges or user interaction.
CVE-2026-42869 is a critical improper authentication vulnerability in SOCFortress CoPilot versions prior to 0.1.57. The product shipped with a hardcoded JWT signing secret used as a fallback if the JWT_SECRET environment variable was not set. This secret was publicly known and included in example configuration files. An unauthenticated attacker could exploit this to forge admin-level JWT tokens, gaining full control over the application and all managed security tools. The vulnerability has a CVSS score of 10.0 and is fixed in version 0.1.57.