627
Every instance of this program can be placed into diagnostic mode with the same password. Even
worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to
change that password or disable this "functionality."
Example 3:
The following examples show a portion of properties and configuration files for Java and ASP.NET
applications. The files include username and password information but they are stored in cleartext.
This Java example shows a properties file with a cleartext username / password pair.
Example Language: Java (Bad)
# Java Web App ResourceBundle properties file
...
webapp.ldap.username=secretUsername
webapp.ldap.password=secretPassword
...
The following example shows a portion of a configuration file for an ASP.Net application. This
configuration file includes username and password information for a connection to a database but
the pair is stored in cleartext.
Example Language: ASP.NET (Bad)
...
<connectionStrings>
<add name="ud_DEV" connectionString="connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;"
providerName="System.Data.Odbc" />
</connectionStrings>
...
Username and password information should not be included in a configuration file or a properties
file in cleartext as this will allow anyone who can read the file access to the resource. If possible,
encrypt this information.
Example 4:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors used hard-coded credentials in their OT products.
Observed Examples
Reference Description
CVE-2022-29964 Distributed Control System (DCS) has hard-coded passwords for local shell
access
https://www.cve.org/CVERecord?id=CVE-2022-29964
CVE-2021-37555 Telnet service for IoT feeder for dogs and cats has hard-coded password
[REF-1288]
https://www.cve.org/CVERecord?id=CVE-2021-37555
CVE-2021-35033 Firmware for a WiFi router uses a hard-coded password for a BusyBox shell,
allowing bypass of authentication through the UART port
https://www.cve.org/CVERecord?id=CVE-2021-35033
MemberOf Relationships
CWE Version 4.14
CWE-259: Use of Hard-coded Password
CWE-259: Use of Hard-coded Password