By weakness (CWE)

CWE-798: related vulnerabilities

CVEs classified under CWE-798. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

16 published vulnerabilities

• CVE-2026-22312HIGH 8.6

  A network-accessible web server on affected devices uses a hardcoded authentication token to protect its REST API. Because the token is constant and embedded in the device, an attacker on the network can bypass authentication entirely, then read system settings, reconfigure the device, and trigger administrative commands like system reboot—all without any credentials or user interaction.

• CVE-2026-31928HIGH 8.1

  Daktronics DMP-5000, DMP-8000, and VFC-DMP-5000 devices ship with preset administrative accounts that use weak or default credentials. These accounts grant complete system control and cannot be disabled during initial setup or normal operation. An authenticated attacker with network access can exploit these weak credentials to take full control of affected displays and related infrastructure.

• CVE-2026-44825HIGH 8.1

  Apache Solr's authentication setup tool comes with hardcoded default credentials that are silently installed in addition to any user-specified accounts. A remote attacker who knows these public defaults can bypass the security layer entirely and gain full administrative control of the Solr cluster. This affects versions 9.4.0 through 9.10.1 and 10.0.0, but only if the basic authentication setup tool was used during cluster initialization.

• CVE-2019-25722HIGH 7.6

  Dräger's patient monitoring devices contain hard-coded login credentials embedded in their source code and are vulnerable to denial-of-service attacks via malformed network packets. An attacker with physical access can use these credentials to gain unauthorized entry and reconfigure clinical settings. A remote attacker can crash the devices repeatedly, severing network connectivity and interrupting patient monitoring—a particularly serious concern in hospital environments where continuous surveillance is critical to patient care.

• CVE-2026-50213HIGH 7.5

  A validation endpoint in Acer Connect M6E 5G firmware exposes detailed user profile information when attackers submit predictable identification strings. Instead of simply confirming whether an account exists, the endpoint returns full profile data sheets, turning a validation function into a data harvesting tool. An unauthenticated attacker can systematically crawl this endpoint by iterating through common or sequential ID values to collect user profiles at scale.

• CVE-2026-8876HIGH 7.3

  Securly version 3.0.7 of their Chrome Extension contains hardcoded encryption keys embedded directly in the minified JavaScript file. These keys are meant to protect sensitive data like crisis alert keywords and intervention site configurations, but because they're hardcoded and visible in the browser extension code, anyone with access to the extension can decrypt that data. This is a classic case of storing secrets where they shouldn't be stored—effectively rendering the encryption useless.

• CVE-2026-36606HIGH 7.1

  Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909 store backup files that are encrypted with a hardcoded, publicly discoverable key using weak encryption. Anyone who obtains a backup file—whether through direct device access, cloud storage misconfiguration, or phishing—can decrypt it and extract sensitive credentials including the admin password, WiFi pre-shared key, and DDNS login information. This is a local attack that depends on an attacker first gaining access to the backup file itself.

• CVE-2026-49204MEDIUM 6.5

  A firmware vulnerability in Acer Connect M6E 5G devices contains hardcoded credentials embedded in debug modules that should have been removed before release. These credentials provide access to internal AWS Cognito test environments, potentially allowing attackers to authenticate to backend services without legitimate credentials. The flaw affects both the device firmware and the product line itself.

• CVE-2026-25600MEDIUM 6.4

  PDBM application contains a critical cryptographic weakness: a single hard-coded encryption secret embedded in the executable file that is identical across all installations. This secret is used to encrypt and decrypt user credentials stored in the application's configuration files. An attacker with local system access can extract this secret from the PDBM.exe binary, then use it to decrypt stored administrative credentials. Because the default configuration assigns these credentials administrative privileges within PDBM, successful exploitation grants attackers complete control over the application's management functions and operational capabilities.

• CVE-2026-21404MEDIUM 6.3

  NAVTOR NavBox versions up to 4.16.1.20 contain hard-coded credentials embedded in its SOAP (Windows Communication Foundation) implementation. When SOAP functionality is enabled, a local user with basic system access can extract these credentials, authenticate to the SOAP interface, and gain unauthorized access to privileged methods that allow arbitrary file write and overwrite operations on the system. This vulnerability requires local access to trigger but bypasses intended security workflows entirely.

• CVE-2026-9260MEDIUM 6.2

  Canon EOS Network Setting Tool version 1.5.0 and earlier contains hard-coded cryptographic keys that are embedded directly in the application binary. An attacker with local access to an affected system can extract these keys and use them to decrypt or forge network communications intended to be protected by encryption. This is a confidentiality risk that does not require user interaction to exploit.

• CVE-2026-36616MEDIUM 5.9

  Mercusys AC12G (EU) V1 routers contain hardcoded credentials baked directly into the firmware. A researcher can extract a WiFi driver password, RADIUS shared secret, WPS test key, and default network password from the device's production binary. This allows someone with network access to bypass WiFi protections and potentially reach internal network resources, though the attack requires being within radio range and some technical effort to extract and use these credentials.

• CVE-2026-47847MEDIUM 5.3

  Bitnami's MariaDB Galera container images and Helm chart ship with a hardcoded, publicly known username and password (monitor/monitor) that allows replication health checks. This credential cannot be changed during standard deployments and grants database replication privileges from any network location. An attacker who discovers a vulnerable Galera cluster can use this credential to access replication functions, potentially to monitor or interfere with database replication status.

• CVE-2026-56269MEDIUM 4.6

  Flowise, a popular open-source workflow automation platform, contains a hardcoded encryption secret in versions 3.0.13 and earlier. When administrators don't explicitly configure the TOKEN_HASH_SECRET environment variable, the application defaults to a publicly known weak value ('Secre$t'). This secret is used to encrypt sensitive metadata (user IDs and workspace IDs) embedded within authentication tokens. An attacker who discovers or deploys Flowise with this default secret can decrypt the metadata to learn internal identifiers and potentially manipulate them. While this alone doesn't bypass authentication, it could facilitate privilege escalation or lateral movement by revealing system structure and enabling token forgery attempts.

• CVE-2026-13728MEDIUM 4.4

  WatchGuard Fireware OS running on FireCluster deployments may use a hard-coded encryption key under certain rare conditions to encrypt saved credentials for Access Portal resources. If exploited, an attacker with high-level administrative privileges could potentially decrypt and recover those stored credentials. The vulnerability does not affect standalone Fireboxes or devices without Access Portal capability.

• CVE-2026-49323MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in how its wireless control module authenticates with the engine control module. An attacker positioned on the vehicle's internal network can intercept a single authentication exchange and reverse-engineer the motorcycle's immobilizer secret—the cryptographic key that prevents unauthorized engine starts. Once recovered, the attacker can bypass the immobilizer entirely and start the engine without the key fob.