CWE-798 vulnerabilities

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.

Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.

Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote attackers to bypass hash verification by supplying 'test' as the hash parameter. Attackers can access the vulnerable endpoint via the add_wpeevent_button_qr action to retrieve sensitive order details including PayPal transaction IDs, customer email addresses, purchase amounts, and ticket information for any order with a known or guessed post ID.

D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot via /etc/init0.d/S80telnetd.sh with the username "Alphanetworks" and the static password "whdrv01_dlob_dir456U" read from /etc/config/image_sign. The custom telnetd binary accepts a -u user:password flag, and the custom login binary uses strcmp() to validate credentials. Successful authentication grants an unauthenticated attacker on the local network a root shell with full administrative control. The device has reached End-of-Life (EOL) and will not receive patches.

The D-Link DIR-600L Hardware Revision A1 firmware contains a hardcoded telnet backdoor with static credentials. This backdoor launches a telnet daemon at boot, allowing anyone on the local network to authenticate using the fixed username "Alphanetworks" and password "wrgn35_dlwbr_dir600l". Successful login grants root shell access, providing full administrative control. The device is End-of-Life and will not receive patches to address this vulnerability. The CVSS score is 9.8, indicating a critical severity level.

The D-Link DIR-600L Hardware Revision B1 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor starts a telnet daemon at boot using the username "Alphanetworks" and a static password stored in a configuration file. Authentication is performed via a custom login binary using simple string comparison, granting root shell access to any attacker on the local network without prior authentication. The device is End-of-Life and will not receive patches for this vulnerability. The CVSS score is 9.8, indicating critical severity.

The D-Link DIR-605L Hardware Revision B2 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor starts a telnet daemon at boot, allowing anyone on the local network to authenticate using the static username "Alphanetworks" and password "wrgn76_dlwbr_dir605L". Successful login grants root shell access with full administrative privileges. The device is End-of-Life and will not receive any patches to address this vulnerability. The CVSS score is 9.8, indicating a critical severity level.

The D-Link DIR-605L Hardware Revision A1 firmware contains a hardcoded telnet backdoor with fixed credentials. This backdoor runs a telnet daemon at boot, allowing anyone on the local network to authenticate using the static username "Alphanetworks" and password "wrgn35_dlwbr_dir605l". Successful login grants root shell access with full administrative privileges. The device is End-of-Life and will not receive patches to address this vulnerability.

Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.

Milesight MS-Cxx63-PD AIOT cameras in specific firmware versions contain hard-coded credentials, which represent a security vulnerability. This issue is tracked as CVE-2026-27785 and is classified under CWE-798. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.7. There is no official patch or remediation level currently indicated by the vendor or advisory. No known exploits in the wild have been reported to date.

CVE-2026-35503 is a critical vulnerability in the SenseLive X3050 web management interface where authentication is improperly handled on the client side using hardcoded credentials in browser-executed scripts. This design flaw allows an attacker who can access the login page to extract these credentials and gain unauthorized administrative access. The vulnerability affects version V1.523 of the product and has a high CVSS score of 9.3, indicating severe impact. No official patch or remediation guidance is currently available from the vendor. Exploits are not known to be in the wild at this time.

CVE-2026-5189 is a critical vulnerability in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 involving the use of hard-coded credentials. An unauthenticated attacker with network access can exploit this issue if the non-default configuration nexus.orient.binaryListenerEnabled=true is enabled. Successful exploitation allows unauthorized read/write access to the internal database and execution of arbitrary OS commands as the Nexus process user. The vulnerability has a CVSS 4.

CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TTS_Remote_Telemetry` class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them in the application’s database. An attacker with sufficient privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment.

AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket. Using the keys directly might give the attacker greater access than the app itself. Key grants AT LEAST read access to some of the objects in bucket. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 8.0.21.0610 and 8.0.22.0524 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.

HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.

HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.