Hardcoded Credentials
Monthly
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
The EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via SSH and gain full control of the device. All units share the same static credential, which can be recovered from firmware analysis, and no special configuration is needed. This is a high-severity flaw (CVSS 9.3) with no public exploit code identified at time of analysis.
Xiongmai XM530 IP cameras running firmware HMT.CM2005-v220608.1837 or earlier ship with static, hardcoded administrative credentials that are stored in cleartext in bin/config.xml and compiled directly into the Sofia executable, so any remote attacker who can reach the device can log in with the same known username/password pair and obtain full administrative control. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the attack is network-reachable, unauthenticated and requires no user interaction, and because the credential set is identical across units, exploitation scales trivially against any exposed camera. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), although that score understates the risk for internet-facing devices given that the only real prerequisites are network reachability and unpatched firmware.
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
The EVbee DC-80 firmware ships with a hardcoded root password, allowing unauthenticated remote attackers to log in via SSH and gain full control of the device. All units share the same static credential, which can be recovered from firmware analysis, and no special configuration is needed. This is a high-severity flaw (CVSS 9.3) with no public exploit code identified at time of analysis.
Xiongmai XM530 IP cameras running firmware HMT.CM2005-v220608.1837 or earlier ship with static, hardcoded administrative credentials that are stored in cleartext in bin/config.xml and compiled directly into the Sofia executable, so any remote attacker who can reach the device can log in with the same known username/password pair and obtain full administrative control. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the attack is network-reachable, unauthenticated and requires no user interaction, and because the credential set is identical across units, exploitation scales trivially against any exposed camera. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), although that score understates the risk for internet-facing devices given that the only real prerequisites are network reachability and unpatched firmware.
Hardcoded Langfuse API credentials embedded in PentestGPT 1.0.0's core telemetry module expose all user session telemetry to unauthorized third parties. Any actor who reads the public GitHub repository can extract the literal API key pair from pentestgpt/core/langfuse.py:114 and authenticate directly to the Langfuse observability backend, gaining read access to pentest session traces that may contain targets, findings, and full AI prompt-response histories. No public exploit or CISA KEV listing exists, though the source reference functionally serves as exploit documentation; EPSS is 0.22% at the 12th percentile.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.