Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2022-22056CRITICALLe-yan Co., Ltd. dental management system - Hard-coded CredentialsEPSS 2.3%CVE-2026-19900CRITICALLB-LINK X-PRO shadow hard-coded credentialsEPSS 2.2%CVE-2024-9486CRITICALVM images built with Image Builder and Proxmox provider use default credentialsEPSS 2.2%CVE-2021-21913CRITICALAn information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network EPSS 2.2%CVE-2021-35961CRITICALTAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded CredentialsEPSS 2.2%CVE-2023-31184MEDIUMROZCOM clientEPSS 2.1%CVE-2025-25570CRITICALVue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.EPSS 2.1%CVE-2018-5399CRITICALThe Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running and is configured with a hard-coded credentialsEPSS 2.1%CVE-2025-69971CRITICALFUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to signEPSS 2.1%CVE-2021-45458—Hardcoded credentialsEPSS 2.1%CVE-2021-41299CRITICALECOA BAS controller - Use of Hard-coded CredentialsEPSS 2.1%CVE-2019-13543MEDIUMMedtronic Valleylab FT10 and FX8 Use of Hard-coded CredentialsEPSS 2.0%CVE-2019-3918—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH iEPSS 2.0%CVE-2022-3214CRITICALDelta Electronics DIAEnergy Use of Hard-coded CredentialsEPSS 2.0%CVE-2020-6985—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded serEPSS 1.9%CVE-2018-10633—Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset EPSS 1.8%CVE-2022-25246CRITICALPTC Axeda agent and Axeda Desktop Server Use of Hard-Coded CredentialsEPSS 1.8%CVE-2020-1615CRITICALJunos OS: vMX: Default credentials supplied in vMX configurationEPSS 1.8%CVE-2018-4846—A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use ofEPSS 1.8%CVE-2021-39613HIGHD-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/pEPSS 1.7%