1479
Scope Impact Likelihood
Other Varies by Context
Demonstrative Examples
Example 1:
The following code is an example of an internal hard-coded password in the back-end:
Example Language: C (Bad)
int VerifyAdmin(char *password) {
if (strcmp(password, "Mew!")) {
printf("Incorrect Password!\n");
return(0)
}
printf("Entering Diagnostic Mode...\n");
return(1);
}
Example Language: Java (Bad)
int VerifyAdmin(String password) {
if (!password.equals("Mew!")) {
return(0)
}
//Diagnostic Mode
return(1);
}
Every instance of this program can be placed into diagnostic mode with the same password. Even
worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to
change that password or disable this "functionality."
Observed Examples
Reference Description
CVE-2022-29953 Condition Monitor firmware has a maintenance interface with hard-coded
credentials
https://www.cve.org/CVERecord?id=CVE-2022-29953
CVE-2000-0127 GUI configuration tool does not enable a security option when a checkbox
is selected, although that option is honored when manually set in the
configuration file.
https://www.cve.org/CVERecord?id=CVE-2000-0127
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
CWE-672: Operation on a Resource after Expiration or Release
Weakness ID : 672
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-672: Operation on a Resource after Expiration or Release
CWE-672: Operation on a Resource after Expiration or Release