CVE-2024-56429

The CVE-2024-56429 entry impacts itech iLabClient 3.7.1, where a hard-coded encryption/DB-access key YngAYdgAE/kKZYu2F2wm6w== in iLabClient.jar enables local users to read or write to the database. Root cause is the hard-coded key used for database access; no public exploit details are provided i...

PT-2025-22343 · Echarge Hardy Barth · Cph2 / Cpp2 Charging Stations

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns several scripts in the web interface that are accessible via undocumented hard-coded credentials. These scripts provide access to additional administrative and debug...

CVE-2025-48416: Hidden Functionality

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be...

ConnectWise Risk Assessment – Security Vulnerabilities

ConnectWise Risk Assessment is a cybersecurity risk assessment tool from ConnectWise that identifies vulnerabilities, compliance gaps, and provides remediation recommendations in enterprise IT environments to help MSPs and organizations achieve proactive risk management. ConnectWise Risk Assessme...

CVE-2025-4876: Use of Hard-coded Cryptographic Key

ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained t...

CVE-2025-27488

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

CVE-2025-27488

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

CVE-2025-27488

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

CVE-2025-27488

CVE-2025-27488 affects Microsoft Windows Hardware Lab Kit (HLK). The vulnerability arises from use of hard-coded credentials in HLK, enabling an authorized attacker to elevate privileges locally. The CVE is tracked in multiple feeds (NVD, MSRC) with a CVSSv3 base score of 6.7 (Medium) and a local...

Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

CVE-2025-45746: Use of Hard-coded Cryptographic Key

In ZKT ZKBio CVSecurity 6.4.1R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and...

CVE-2025-27488: Use of Hard-coded Credentials

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally...

ZKTeco ZKBio CVSecurity Trust Management Vulnerability

ZKTeco ZKBio CVSecurity is a series of biometric solutions from the Chinese company ZKTeco. A trust management issue vulnerability exists in ZKTeco ZKBio CVSecurity version 6.4.1R, which stems from a hard-coded key that could lead to unverified JWT token authentication...

PT-2025-20943 · Microsoft · Windows Hardware Lab Kit

Name of the Vulnerable Software and Affected Versions: Windows Hardware Lab Kit affected versions not specified Description: The issue concerns the use of hard-coded credentials in the software, which allows an authorized attacker to elevate privileges locally. There is no information provided...

CVE-2025-47730: Use of Hard-coded Credentials

The TeleMessage archiving backend through 2025-05-05 accepts API calls to request an authentication token from the TM SGNL aka Archive Signal app with the credentials of logfile for the user and enRR8UVVywXYbFkqUQDPRkO for the password...

CVE-2025-20188

A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. Th...

Cisco IOS XE Trust Management Vulnerability

Cisco IOS XE is an operating system from Cisco, Inc. Used as a single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity. Cisco IOS XE suffers from a trust management issue vulnerability that stems from...

CVE-2025-20188: Use of Hard-coded Credentials

A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. Th...

NVIDIA NvContainer Trust Management Issue Vulnerability

NVIDIA NvContainer is a container management service from NVIDIA. NVIDIA NvContainer suffers from a trust management issue vulnerability that stems from a hard-coded path issue in the use of OpenSSL, which could be exploited by an attacker to cause code execution, denial of service, elevation of...

CVE-2025-4041 Use of Hard-coded Credentials Optigo Networks ONS NC600

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...