CWE-259βUse of Hard-coded Password
PUBLISHEDweakness recordHigh
released 2006-07-19 Β· last modified 2025-12-11
Metadata
- CWE ID:
- CWE-259
- Abstraction:
- Variant
- Structure:
- Simple
- Status:
- Draft
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2025-12-11
Weakness Name
Use of Hard-coded Password
Description
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
There are two main variations of a hard-coded password:
Common Consequences
- Scope:
- Access Control
- Impact:
- Gain Privileges or Assume Identity
- Notes:
- If hard-coded passwords are used, it is almost certain that malicious users can gain access through the account in question.
- Scope:
- Access Control
- Impact:
- Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability
- Notes:
- A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely.
