1696
...
The following example shows a portion of a configuration file for an ASP.Net application. This
configuration file includes username and password information for a connection to a database but
the pair is stored in cleartext.
Example Language: ASP.NET (Bad)
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
Username and password information should not be included in a configuration file or a properties
file in cleartext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
Example 5:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors used hard-coded credentials in their OT products.
Observed Examples
Reference Description
CVE-2022-29953 Condition Monitor firmware has a maintenance interface with hard-coded
credentials
https://www.cve.org/CVERecord?id=CVE-2022-29953
CVE-2022-29960 Engineering Workstation uses hard-coded cryptographic keys that could allow
for unathorized filesystem access and privilege escalation
https://www.cve.org/CVERecord?id=CVE-2022-29960
CVE-2022-29964 Distributed Control System (DCS) has hard-coded passwords for local shell
access
https://www.cve.org/CVERecord?id=CVE-2022-29964
CVE-2022-30997 Programmable Logic Controller (PLC) has a maintenance service that uses
undocumented, hard-coded credentials
https://www.cve.org/CVERecord?id=CVE-2022-30997
CVE-2022-30314 Firmware for a Safety Instrumented System (SIS) has hard-coded credentials
for access to boot configuration
https://www.cve.org/CVERecord?id=CVE-2022-30314
CVE-2022-30271 Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely
to be used in typical deployments
https://www.cve.org/CVERecord?id=CVE-2022-30271
CVE-2021-37555 Telnet service for IoT feeder for dogs and cats has hard-coded password
[REF-1288]
https://www.cve.org/CVERecord?id=CVE-2021-37555
CVE-2021-35033 Firmware for a WiFi router uses a hard-coded password for a BusyBox shell,
allowing bypass of authentication through the UART port
https://www.cve.org/CVERecord?id=CVE-2021-35033
CVE-2012-3503 Installation script has a hard-coded secret token value, allowing attackers to
bypass authentication
CWE Version 4.14
CWE-798: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials