CWE-259 vulnerabilities

Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.

The Siklu EtherHaul 8010 device with firmware version siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b contains a hard-coded static root password. This vulnerability is identified as CVE-2025-57175 and is categorized under CWE-259. The presence of a static root password can allow unauthorized users with network access to gain high-level privileges on the device. The CVSS v3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild reported at this time.

A hardcoded password vulnerability exists in Yokogawa Electric Corporation's CENTUM VP products across multiple versions. The vulnerability involves a hardcoded password for the PROG user account used in CENTUM Authentication Mode. Exploitation requires an attacker to already have access to the HIS screen controls and the system to be configured in CTM authentication mode. The default permissions for the PROG user are limited, reducing the risk of critical operations being performed. The vulnerability is rated low severity with a CVSS score of 2.1. No patch or remediation information is provided in the available data.

CVE-2025-59388 is a medium-severity vulnerability in QNAP Systems Inc. 's Hyper Data Protector version 2.3.x. It is caused by the use of a hard-coded password (CWE-259), which allows remote attackers to gain unauthorized access without any authentication or user interaction. The vulnerability has been fixed in version 2.3.1.455 and later. Exploitation requires no privileges and no user interaction, making it relatively easy to exploit remotely.

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products.

An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available software. This password can then be used to decrypt sensitive network traffic, affecting the Cognex device.

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.

Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.

Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.

Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.

A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations. This issue affects Estomed Sp.z o.o. Simple Care software in all versions. The software is no longer supported.