CWE-798: Use of Hard-coded Credentials
ID
CWE-798
Abstraction
Base
Structure
Simple
Status
Draft
Number of CVEs
1257
The product contains hard-coded credentials, such as a password or cryptographic key.
There are two main variations:
- Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
- Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
Modes of Introduction
Phase | Note |
---|---|
Architecture and Design | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Applicable Platforms
Type | Class | Name | Prevalence |
---|---|---|---|
Language | Not Language-Specific | ||
Technology | Mobile | ||
Technology | ICS/OT |
Relationships
View | Weakness | |||||||
---|---|---|---|---|---|---|---|---|
# ID | View | Status | # ID | Name | Abstraction | Structure | Status | |
CWE-1000 | Research Concepts | Draft | CWE-1391 | Use of Weak Credentials | Class | Simple | Incomplete | |
CWE-1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities | Incomplete | CWE-287 | Improper Authentication | Class | Simple | Draft | |
CWE-1000 | Research Concepts | Draft | CWE-344 | Use of Invariant Value in Dynamically Changing Context | Base | Simple | Draft | |
CWE-1000 | Research Concepts | Draft | CWE-671 | Lack of Administrator Control over Security | Class | Simple | Draft | |
CWE-1000 | Research Concepts | Draft | CWE-257 | Storing Passwords in a Recoverable Format | Base | Simple | Incomplete |
Common Attack Pattern Enumeration and Classification (CAPEC)
The Common Attack Pattern Enumeration and Classification (CAPECâ„¢) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.
CAPEC at Mitre.orgCVEs Published
CVSS Severity
CVSS Severity - By Year
CVSS Base Score
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |
Loading...