CWE-798 - Use of Hard-coded Credentials

Description

Knowledge of the hard-coded credentials let attackers to evade the authenticationand and be able to get sensitive patient information. To identify and especially fix the hole, created by the hard-coded credentials, system administrator should totally disable the product.
Two main variations are used.
Inbound: an authentication mechanism of software control and check all the input credentials, not allowing access to any hard-coded credentials.
Outbound: for connection with another system or component software uses hard-coded credentials, containing in that component.
Using of hard-coded passwords helps attackers to cause resource functionality exposure, breach of sensitive information or even arbitrary code execution.
The weakness is intoduced during Architecure and Design stage.

Latest vulnerabilities for CWE-798

Multiple vulnerabilities in IBM Cognos Controller 2024-12-06
High Yes Public exploit

Multiple vulnerabilities in SonicWall SMA100 series 2024-12-05
High Yes Public exploit

Multiple vulnerabilities in Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert and Modicon M340, M580 and M580 Safety PLCs 2024-11-29
High Yes

Multiple vulnerabilities in Baxter Life2000 Ventilation System 2024-11-19
High No

Multiple vulnerabilities in LevelOne WBR-6012 2024-10-31
High No

Multiple vulnerabilities in Moxa MXsecurity 2024-10-21
Medium Yes

Multiple vulnerabilities in Kastle Systems Access Control System 2024-09-23
High Yes

Multiple vulnerabilities in Viessmann Climate Solutions Vitogate 300 2024-09-16
High Yes Public exploit

Multiple vulnerabilities in SolarWinds Access Rights Manager 2024-09-12
Medium Yes

Multiple vulnerabilities in Cisco Smart Licensing Utility 2024-09-04
Critical Yes

References

Description of CWE-798 on Mitre website