CWE-259—Use of Hard-coded Password
PUBLISHEDweakness recordHigh
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-259
- 摘要：
- Variant
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Use of Hard-coded Password
描述
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
There are two main variations of a hard-coded password:
常见后果
- 范围：
- Access Control
- 影响：
- Gain Privileges or Assume Identity
- 注释：
- If hard-coded passwords are used, it is almost certain that malicious users can gain access through the account in question.
- 范围：
- Access Control
- 影响：
- Gain Privileges or Assume Identity, Hide Activities, Reduce Maintainability
- 注释：
- A hard-coded password typically leads to a significant authentication failure that can be difficult for the system administrator to detect. Once detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely.
