CWE-798Use of Hard-coded Credentials

Description

The product contains hard-coded credentials, such as a password or cryptographic key.

Common consequences

• Access Control→Bypass Protection Mechanism
  [object Object]
• Integrity,Confidentiality,Availability,Access Control,Other→Read Application Data,Gain Privileges or Assume Identity,Execute Unauthorized Code or Commands,Other
  [object Object]

Potential mitigations

• Architecture and Design
  [object Object]
• Architecture and Design
  For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
• Architecture and Design
  If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
• Architecture and Design
  [object Object]
• Architecture and Design
  [object Object]

Related CWEs

Recent CVEs classified under this CWE