PT-2025-12347

Name of the Vulnerable Software and Affected Versions Audi UTR Dashcam version 2.0 Description A vulnerability was found in the Audi UTR Dashcam, affecting an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be...

CVE-2025-2538: Use of Hard-coded Credentials

A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system...

CVE-2025-2556: Use of Hard-coded Credentials

A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be initiated within the local network. The exploit h...

CVE-2025-2555: Use of Hard-coded Password

A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather...

CVE-2024-12433: Deserialization of Untrusted Data

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the serve...

CVE-2024-48831

Dell SmartFabric OS10 Software, versions 10.5.6.x, contains a Use of Hard-coded Password vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2019-17659

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

PT-2025-11659

Name of the Vulnerable Software and Affected Versions SmartOS version 60f76fd2-143f-4f57-819b-1ae32684e81b Description The issue concerns static host SSH keys in a specific Debian 12 LX zone image. This could potentially allow unauthorized access. The estimated number of affected devices is not...

CVE-2025-30234: Use of Hard-coded Cryptographic Key

SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image a Debian 12 LX zone image from 2024-07-26...

CVE-2025-2343

A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionality of the component Device Pairing. The manipulation leads to hard-coded credentials. Access to the local network is required for this atta...

CVE-2025-2342

A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpoint. The manipulation leads to hard-coded credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the...

IROAD APK security vulnerabilities

The IROAD APK is a mobile application from IROAD that works with the IROAD Car Recorder. A security vulnerability exists in IROAD APK version 5.2.5, which stems from the use of hard-coded credentials on ports 9091 and 9092 in the APK, which could allow an attacker to access the API endpoint and...

CVE-2025-30122: Use of Hard-coded Credentials

An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain unauthorized access to multiple devices...

IROAD V Series security vulnerabilities

IROAD V Series is a series of car recorders from IROAD. The IROAD V Series suffers from a security vulnerability that stems from the use of hard-coded default credentials in the car recorder, which allows an attacker to connect to the device's network within Wi-Fi range to sniff it...

Forvia Hella HELLA Driving Recorder DR 820 security vulnerability

Forvia Hella HELLA Driving Recorder DR 820 is a driving recorder from Forvia. A security vulnerability exists in Forvia Hella HELLA Driving Recorder DR 820, which stems from the use of hard-coded credentials on ports 9091 and 9092 in the APK, which allows an attacker to gain unauthorized access t...

CVE-2025-30115: Use of Hard-coded Password

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password "qwertyuiop", which cannot be modified by users. The SSID is continuously broadcast, allowing unauthorized access to the device network...

ROADCAM X3 security vulnerabilities

ROADCAM X3 is a car recorder with HD quality and easy to carry by ROADCAM. It is used to record the process of driving, and supports video cropping, sharing and other functions. ROADCAM X3 suffers from a security vulnerability that originates from the inclusion of hard-coded FTP credentials in th...

CVE-2025-30123: Use of Hard-coded Credentials

An issue was discovered on ROADCAM X3 devices. The mobile app APK Viidure contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device...

CVE-2024-48831

Dell SmartFabric OS10 Software, versions 10.5.6.x, contains a Use of Hard-coded Password vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...