CWE-259 - Use of Hard-coded Password
- Abstraction:Variant
- Structure:Simple
- Status:Draft
- Release Date:2006-07-19
- Latest Modification Date:2025-04-03
Weakness Name
Use of Hard-coded Password
Description
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
There are two main variations of a hard-coded password:
Common Consequences
Scope: Access Control
Impact: Gain Privileges or Assume Identity
Notes: If hard-coded passwords are used, it is almost certain that malicious users can gain access through the account in question.
Scope: Access Control
Impact: Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability
Notes: A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely.
Related Weaknesses
CWE-257Storing Passwords in a Recoverable FormatHigh