CWE-798Use of Hard-coded Credentials

Description

Common consequences· 2

• Access Control — Bypass Protection Mechanism
• Integrity / Confidentiality / Availability / Access Control / Other — Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands, Other

Potential mitigations· 5

• [Architecture and Design]
• [Architecture and Design]For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
• [Architecture and Design]If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
• [Architecture and Design]
• [Architecture and Design]

Related CAPEC attack patterns· 2

Exploits (incoming)2

Compliance frameworks addressing this (incoming)30

(incoming)118

Showing top 30 of 118 by confidence. Click any target to see the full neighbourhood.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.