Weakness · CWE-798
Use of Hard-coded Credentials
A password or key is baked into the product, identical on every install and easy to find.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-92450E3 Firmware: Kiloview E3 NDI Encoder Use of Hard-coded CredentialsHigh 8.7
- CVE-2026-105278Grid Protection Alliance openPDC (Docker image) Use of Hard-coded CredentialsCritical 9.3
- CVE-2026-107617EseeCloud App: Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded CredentialsCritical 9.3
- CVE-2026-27873Medium 5.6
- CVE-2026-32645Red Lion Controls N-Tron 700 Series Use of Hard-Coded CredentialsCritical 9.2
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- AC-6Least PrivilegeAccess Control · mitigates 5 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 5 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 4 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 4 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 4 techniques
- SI-2Flaw RemediationSystem and Information Integrity · mitigates 4 techniques
- AC-2Account ManagementAccess Control · mitigates 3 techniques
- AC-4Information Flow EnforcementAccess Control · mitigates 3 techniques
- AC-5Separation of DutiesAccess Control · mitigates 3 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 3 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.