CWE-259

Use of Hard-coded Password

50 CVEs Avg CVSS 6.7 MITRE
6
CRITICAL
20
HIGH
13
MEDIUM
11
LOW
12
POC
0
KEV

Monthly

CVE-2025-57175 MEDIUM This Month

Siklu EtherHaul 8010 wireless backhaul devices contain a static root password that enables physical attackers or those with local console access to gain complete administrative control without authentication. The vulnerability affects firmware version 10.6.2-18707 and potentially other versions of the EtherHaul 8010 product line, allowing credential-based authentication bypass with high confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at this time, though the CVSS:3.1 physical attack vector (AV:P) reflects that an attacker must have direct physical access to the device's console interfaces.

Authentication Bypass
NVD
CVSS 3.1
6.4
EPSS
0.0%
CVE-2025-7741 LOW CISA Monitor

Hardcoded password vulnerability in Yokogawa CENTUM VP allows authentication bypass for the PROG system account across versions R5.01.00-R5.04.20, R6.01.00-R6.12.00, and R7.01.00. An attacker who obtains the hardcoded credential and has direct access to the Human Interface Station (HIS) running CTM authentication mode can log in as PROG; however, real-world risk is constrained because PROG defaults to S1 (OFFUSER) permission level, and exploitation requires pre-existing HIS access. No public exploit code or active CISA KEV status identified at time of analysis.

Authentication Bypass
NVD VulDB
CVSS 4.0
2.1
EPSS
0.0%
CVE-2026-4475 HIGH This Week

A hard-coded credentials vulnerability exists in Yi Technology YI Home Camera 2 firmware version 2.1.1_20171024151200, specifically in the home/web/ipc file component. An unauthenticated attacker on the local network can exploit these credentials to gain full access to the device with high impact on confidentiality, integrity, and availability (CVSS 8.8). The exploit has been publicly disclosed via VulDB references, and the vendor did not respond to early disclosure attempts, indicating no official patch is available.

Authentication Bypass
NVD VulDB
CVSS 3.1
8.8
EPSS
0.0%
CVE-2025-59388 CRITICAL Act Now

QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.

Authentication Bypass Hyper Data Protector
NVD VulDB
CVSS 3.1
9.8
EPSS
0.2%
CVE-2025-70802 HIGH This Week

Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]

Authentication Bypass Tenda
NVD GitHub VulDB
CVSS 3.1
8.4
EPSS
0.0%
CVE-2025-70798 HIGH This Week

Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]

Authentication Bypass Tenda
NVD GitHub VulDB
CVSS 3.1
8.4
EPSS
0.0%
CVE-2026-2702 LOW Monitor

A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the component WPA2 PSK. Performing a manipulation results in hard-coded credentials. The attacker must have access to the local network to execute the attack. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did ...

Authentication Bypass
NVD GitHub VulDB
CVSS 3.1
3.1
EPSS
0.0%
CVE-2026-2616 HIGH POC This Week

Hard-coded credentials in the Beetel 777VR1 Web Management Interface allow unauthenticated attackers on the local network to gain full administrative access with high integrity and confidentiality impact. Public exploit code is available and actively used, with no patch currently available from the vendor. Affected organizations should immediately implement network segmentation and access controls to restrict management interface exposure.

Authentication Bypass 777vr1 Firmware
NVD GitHub VulDB
CVSS 3.1
8.8
EPSS
0.2%
CVE-2026-25753 CRITICAL Act Now

PlaciPy placement management system 1.0.0 uses a hard-coded password, allowing any attacker who discovers it to gain full system access.

Authentication Bypass Placipy
NVD GitHub
CVSS 3.1
9.8
EPSS
0.1%
CVE-2026-1610 HIGH This Week

Ax12 Pro Firmware versions up to 16.03.49.24_cn is affected by use of hard-coded password (CVSS 8.1).

Authentication Bypass Ax12 Pro Firmware
NVD GitHub VulDB
CVSS 3.1
8.1
EPSS
0.0%
CVE-2025-57175
EPSS 0% CVSS 6.4
MEDIUM This Month

Siklu EtherHaul 8010 wireless backhaul devices contain a static root password that enables physical attackers or those with local console access to gain complete administrative control without authentication. The vulnerability affects firmware version 10.6.2-18707 and potentially other versions of the EtherHaul 8010 product line, allowing credential-based authentication bypass with high confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at this time, though the CVSS:3.1 physical attack vector (AV:P) reflects that an attacker must have direct physical access to the device's console interfaces.

Authentication Bypass
NVD
CVE-2025-7741
EPSS 0% CVSS 2.1
LOW Monitor

Hardcoded password vulnerability in Yokogawa CENTUM VP allows authentication bypass for the PROG system account across versions R5.01.00-R5.04.20, R6.01.00-R6.12.00, and R7.01.00. An attacker who obtains the hardcoded credential and has direct access to the Human Interface Station (HIS) running CTM authentication mode can log in as PROG; however, real-world risk is constrained because PROG defaults to S1 (OFFUSER) permission level, and exploitation requires pre-existing HIS access. No public exploit code or active CISA KEV status identified at time of analysis.

Authentication Bypass
NVD VulDB
CVE-2026-4475
EPSS 0% CVSS 8.8
HIGH This Week

A hard-coded credentials vulnerability exists in Yi Technology YI Home Camera 2 firmware version 2.1.1_20171024151200, specifically in the home/web/ipc file component. An unauthenticated attacker on the local network can exploit these credentials to gain full access to the device with high impact on confidentiality, integrity, and availability (CVSS 8.8). The exploit has been publicly disclosed via VulDB references, and the vendor did not respond to early disclosure attempts, indicating no official patch is available.

Authentication Bypass
NVD VulDB
CVE-2025-59388
EPSS 0% CVSS 9.8
CRITICAL Act Now

QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.

Authentication Bypass Hyper Data Protector
NVD VulDB
CVE-2025-70802
EPSS 0% CVSS 8.4
HIGH This Week

Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]

Authentication Bypass Tenda
NVD GitHub VulDB
CVE-2025-70798
EPSS 0% CVSS 8.4
HIGH This Week

Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. [CVSS 8.4 HIGH]

Authentication Bypass Tenda
NVD GitHub VulDB
CVE-2026-2702
EPSS 0% CVSS 3.1
LOW Monitor

A security flaw has been discovered in Beetel 777VR1 up to 01.00.09. This issue affects some unknown processing of the component WPA2 PSK. Performing a manipulation results in hard-coded credentials. The attacker must have access to the local network to execute the attack. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did ...

Authentication Bypass
NVD GitHub VulDB
CVE-2026-2616
EPSS 0% CVSS 8.8
HIGH POC This Week

Hard-coded credentials in the Beetel 777VR1 Web Management Interface allow unauthenticated attackers on the local network to gain full administrative access with high integrity and confidentiality impact. Public exploit code is available and actively used, with no patch currently available from the vendor. Affected organizations should immediately implement network segmentation and access controls to restrict management interface exposure.

Authentication Bypass 777vr1 Firmware
NVD GitHub VulDB
CVE-2026-25753
EPSS 0% CVSS 9.8
CRITICAL Act Now

PlaciPy placement management system 1.0.0 uses a hard-coded password, allowing any attacker who discovers it to gain full system access.

Authentication Bypass Placipy
NVD GitHub
CVE-2026-1610
EPSS 0% CVSS 8.1
HIGH This Week

Ax12 Pro Firmware versions up to 16.03.49.24_cn is affected by use of hard-coded password (CVSS 8.1).

Authentication Bypass Ax12 Pro Firmware
NVD GitHub VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy