What is CWE-798: Use of Hard-coded Credentials?+
CWE-798: Use of Hard-coded Credentials is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product contains hard-coded credentials, such as a password or cryptographic key. There are two main variations: Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect. Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
Is CWE-798 in the CWE Top 25 Most Dangerous Software Weaknesses?+
Yes. CWE-798 ranked #13 in the CWE Top 25 for 2024, associated with 262 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.
What are the security consequences of Use of Hard-coded Credentials?+
If exploited, CWE-798 (Use of Hard-coded Credentials) it can compromise Access Control, Integrity, Confidentiality, Availability and Other, leading to outcomes such as Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands and Other.
How do you prevent or mitigate Use of Hard-coded Credentials?+
Recommended mitigations for CWE-798 include: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7]. In Windows environments, the Encrypted File System (EFS) may provide some protection. For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key. If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
How is Use of Hard-coded Credentials detected?+
CWE-798 can be detected using Black Box, Automated Static Analysis, Manual Static Analysis, Manual Dynamic Analysis, Automated Static Analysis - Binary or Bytecode and Manual Static Analysis - Binary or Bytecode. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Use of Hard-coded Credentials?+
CWE-798 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Use of Hard-coded Credentials?+
MITRE documents real CVEs mapped to CWE-798, including CVE-2022-40263, CVE-2022-29953, CVE-2022-29960, CVE-2022-29964 and CVE-2022-30997. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-798 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.