CWE-798: CWE-798: Use of Hard-coded Credentials

CWE-798: CWE-798: Use of Hard-coded Credentials is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Description Extended Description

Yes. CWE-798 ranked #13 in the CWE Top 25 for 2024, associated with 262 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

If exploited, CWE-798 (CWE-798: Use of Hard-coded Credentials) it can compromise Bypass Protection Mechanism, Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands and Other, leading to outcomes such as Scope: Access Control If hard-coded passwords are used, it is almost certain that malicious users will gain access to the account in question. Any user of the product that hard-codes passwords may be able to extract the password. Client-side systems with hard-coded passwords pose even more of a threat, since the extraction of a password from a binary is usually very simple., Scope: Integrity, Confidentiality and Availability.

Recommended mitigations for CWE-798 include: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key ( CWE-320 ). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [ REF-7 ]. In Windows environments, the Encrypted File System (EFS) may provide some protection. For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key. If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.

CWE-798 commonly affects Languages. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

A CWE (Common Weakness Enumeration) like CWE-798 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.