logo
Home/CWEs/CWE-259/

CWE-259 - Use of Hard-coded Password

  • Abstraction:Variant
  • Structure:Simple
  • Status:Draft
  • Release Date:2006-07-19
  • Latest Modification Date:2025-04-03

Weakness Name

Use of Hard-coded Password

Description

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

There are two main variations of a hard-coded password:

Common Consequences

Scope: Access Control

Impact: Gain Privileges or Assume Identity

Notes: If hard-coded passwords are used, it is almost certain that malicious users can gain access through the account in question.

Scope: Access Control

Impact: Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability

Notes: A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely.

Related Weaknesses

CWE-257Storing Passwords in a Recoverable FormatHigh

CWE-321Use of Hard-coded Cryptographic KeyHigh

CWE-798Use of Hard-coded CredentialsHigh