On this page

CWE-798: Use of Hard-coded Credentials

Weakness Summary

The product contains hard-coded credentials, such as a password or cryptographic key.

  • Canonical source: MITRE CWE-798
  • Published Atomicorp CVE observations: 22
  • Distinct affected products in those observations: 22
  • Active Atomicorp rules associated with this weakness: 66

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2014-125115Pandora FMS Default Credential / SQLi Remote Code ExecutionPandora FMSProtected by Atomicorp rules331028 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390700
CVE-2012-5686ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password ResetzpanelProtected by Atomicorp rules340016 , 340017 , 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 360147 , 360148 , 390704
CVE-2014-9614Netsweeper 4.0.5 - Default Weak AccountnetsweeperProtected by Atomicorp rules392301
CVE-2015-4667Xceedium Xsuite - Multiple VulnerabilitiesxsuiteProtected by Atomicorp rules320464 , 320465 , 333141 , 340023 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 344360 , 344361 , 344363 , 344370 , 346755 , 347198 , 350148 , 390726 , 392301 , 392647 , 392648
CVE-2016-5678NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilitiesnvrmini 2Protected by Atomicorp rules392301
CVE-2017-18371TrueOnline / ZyXEL P660HN-T v2 Router Authenticated Command Injection5200w-t firmwareProtected by Atomicorp rules340029 , 344363 , 344364 , 344366 , 344370
CVE-2017-7462Intellinet NFC-30IR Camera - Multiple Vulnerabilitiesnfc-30ir firmwareProtected by Atomicorp rules330925 , 344360 , 347009
CVE-2019-1619Cisco Data Center Network Manager Unauthenticated Remote Code Executiondata center network managerProtected by Atomicorp rules330791 , 334168 , 340128 , 340152 , 344360 , 360152 , 380018 , 390709 , 390801
CVE-2019-16399Western Digital My Book World II NAS 1.02.12 - Authentication Bypass / Command Executionwd my book firmwareProtected by Atomicorp rules341245 , 344370
CVE-2019-1935Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilitiesintegrated management controller supervisorProtected by Atomicorp rules344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648
CVE-2020-13166Plesk/myLittleAdmin ViewState .NET DeserializationmylittleadminProtected by Atomicorp rules340145 , 340156 , 341145 , 341245
CVE-2020-4429IBM Data Risk Manager Unauthenticated Remote Code Executiondata risk managerProtected by Atomicorp rules330791 , 334168 , 340006 , 340007 , 340128 , 340152 , 344360 , 347009 , 360152 , 380018 , 390709 , 390719 , 390801 , 391213
CVE-2020-8657EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command ExecutioneyesofnetworkProtected by Atomicorp rules340013 , 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 340181 , 341145 , 341245 , 344363 , 360147 , 360148
CVE-2022-34045WAVLINK WN530HG4 - Improper Access Controlwl-wn530hg4 firmwareProtected by Atomicorp rules390716
CVE-2023-22463KubePi JwtSigKey - Admin Authentication BypasskubepiProtected by Atomicorp rules392301
CVE-2023-45499Vinchin Backup and Recovery Command Injectionvinchin backup and recoveryProtected by Atomicorp rules344361 , 344363 , 344364 , 344366
CVE-2024-3408D-Tale RCEd-taleProtected by Atomicorp rules330791 , 334168 , 340087 , 340095 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2026-44825Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default CredentialssolrProtected by Atomicorp rules330925
CVE-2024-7332TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerabilitycp450 firmwareProtected by Atomicorp rules390716
CVE-2026-19900LB-LINK Routers - Unauthenticated Command Injectionbl-wr9000 firmwareProtected by Atomicorp rules390904
CVE-2021-45841TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.tosProtected by Atomicorp rules340006 , 340007 , 340029 , 344360 , 344364 , 347009 , 390709 , 390719
CVE-2022-28810ManageEngine ADSelfService Plus Custom Script Executionmanageengine adselfservice plusProtected by Atomicorp rules340007 , 340014 , 340029 , 340193 , 344360 , 347009 , 390709

Associated Atomicorp WAF Rules

RuleStatusBehavior
320464Activedisruptive (deny)
320465Activedisruptive (deny)
330791Activedisruptive (deny)
330925Activedisruptive (deny)
331028Activedisruptive (deny)
333141Activedisruptive (deny)
334168Activedisruptive (deny)
340006Activedisruptive (deny)
340007Activedisruptive (deny)
340013Activedisruptive (deny)
340014Activedisruptive (deny)
340016Activedisruptive (deny)
340017Activedisruptive (deny)
340023Activedisruptive (deny)
340029Activedisruptive (deny)
340087Activedisruptive (deny)
340095Activedisruptive (deny)
340099Activedisruptive (deny)
340128Activedisruptive (deny)
340145Activedisruptive (deny)
340147Activedisruptive (deny)
340148Activedisruptive (deny)
340152Activedisruptive (deny)
340156Activedisruptive (deny)
340157Activedisruptive (deny)
340159Activedisruptive (deny)
340181Activedisruptive (deny)
340193Activedisruptive (deny)
341099Activedisruptive (deny)
341145Activedisruptive (deny)
341245Activedisruptive (deny)
341256Activedisruptive (deny)
342259Activedisruptive (deny)
344360Activedisruptive (deny)
344361Activedisruptive (deny)
344362Activedisruptive (deny)
344363Activedisruptive (deny)
344364Activedisruptive (deny)
344366Activedisruptive (deny)
344370Activedisruptive (deny)
345493Activenon-disruptive (pass)
346755Activedisruptive (deny)
347009Activedisruptive (deny)
347198Activedisruptive (deny)
350147Activedisruptive (deny)
350148Activedisruptive (deny)
360147Activedisruptive (deny)
360148Activedisruptive (deny)
360151Activedisruptive (deny)
360152Activedisruptive (deny)
380018Activedisruptive (deny)
380026Activedisruptive (deny)
390700Activedisruptive (deny)
390704Activedisruptive (deny)
390709Activedisruptive (deny)
390716Activedisruptive (deny)
390719Activedisruptive (deny)
390724Activedisruptive (deny)
390726Activedisruptive (deny)
390727Activedisruptive (deny)
390801Activedisruptive (deny)
390904Activedisruptive (deny)
391213Activedisruptive (deny)
392301Activedisruptive (deny)
392647Activedisruptive (deny)
392648Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-191 , CAPEC-70