Use of Hard-coded Password

Description

Use of Hard-coded Password is a vulnerability that occurs when a product contains a password embedded directly in the source code, configuration files, or binary, which is used either for authenticating incoming users (inbound authentication) or for connecting to external components and services (outbound communication). Hard-coded passwords create severe security risks because they cannot be changed without modifying and redeploying the software, are often identical across all installations of the product, and may be discoverable through reverse engineering, source code access, or configuration file analysis. Once a hard-coded password is discovered, all systems using that software become vulnerable until a patched version is deployed.

Risk

Hard-coded passwords represent one of the most severe authentication vulnerabilities because they provide attackers with reliable, persistent access. Once discovered through reverse engineering, leaked source code, or security research, the password works on every installation of the affected software. Changing the password requires software updates that may take months or years to deploy across all affected systems. Many IoT devices and embedded systems with hard-coded credentials remain permanently vulnerable because they lack update mechanisms. The risk is compounded by the tendency to reuse hard-coded passwords across product lines and by the availability of default credential databases that attackers routinely consult. In industrial control systems and critical infrastructure, hard-coded passwords have been implicated in significant security incidents.

Solution

Never embed passwords directly in source code, configuration files, or compiled binaries. Implement initial setup procedures that require administrators to configure unique credentials during installation. Use secure credential storage mechanisms such as hardware security modules, encrypted keystores, or operating system credential managers. For service-to-service authentication, use certificate-based authentication or OAuth tokens instead of passwords. If legacy systems require stored credentials, encrypt them using keys derived from installation-specific values. Implement credential rotation mechanisms that allow password changes without software updates. Conduct code reviews and use static analysis tools to detect hard-coded credentials. Scan binaries and configuration files for credential patterns before release.

Common Consequences

Impact	Details
Access Control	Scope: Access Control If hard-coded passwords are used, it is almost certain that malicious users will eventually gain access to the account in question. The password cannot be changed without modifying and redeploying the product.
Authentication	Scope: Authentication Hard-coded passwords undermine the entire authentication mechanism. Once discovered, attackers can impersonate legitimate users or services, and remediation requires software updates across all affected installations.

Example Code

Vulnerable Code (Java)

The following code demonstrates hard-coded password patterns:

public class VulnerableAuthentication {

    // Vulnerable: Hard-coded password for admin account
    private static final String ADMIN_PASSWORD = "admin123";

    // Vulnerable: Hard-coded database credentials
    private static final String DB_USER = "app_user";
    private static final String DB_PASSWORD = "DbP@ssw0rd!2024";

    public boolean authenticateUser(String username, String password) {
        // Vulnerable: Comparing against hard-coded credential
        if (username.equals("admin") && password.equals(ADMIN_PASSWORD)) {
            return true;
        }

        // Check against database...
        return checkDatabase(username, password);
    }

    public Connection getDatabaseConnection() throws SQLException {
        // Vulnerable: Hard-coded credentials for database
        String url = "jdbc:mysql://localhost:3306/myapp";
        return DriverManager.getConnection(url, DB_USER, DB_PASSWORD);
    }

    // Vulnerable: Hard-coded API key
    public void callExternalService() {
        String apiKey = "sk-live-abc123secretkey456";
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.service.com/data"))
            .header("Authorization", "Bearer " + apiKey)
            .build();
        // Send request...
    }

    // Vulnerable: Hard-coded encryption key
    public byte[] encryptData(byte[] data) {
        // Key embedded in code
        byte[] key = "MySecretKey12345".getBytes();
        // ... encryption logic
        return encrypted;
    }
}

<!-- Vulnerable: Hard-coded password in configuration -->
<!-- config.xml -->
<configuration>
    <database>
        <username>dbadmin</username>
        <password>SuperSecretDB123!</password>  <!-- Exposed! -->
    </database>
    <admin>
        <backdoor-password>masterkey</backdoor-password>  <!-- Exposed! -->
    </admin>
</configuration>

Fixed Code (Java)

public class SecureAuthentication {

    private final CredentialStore credentialStore;
    private final SecretsManager secretsManager;

    public SecureAuthentication(CredentialStore credentialStore,
                                SecretsManager secretsManager) {
        this.credentialStore = credentialStore;
        this.secretsManager = secretsManager;
    }

    public boolean authenticateUser(String username, String password) {
        // Fixed: Retrieve hashed password from secure store
        String storedHash = credentialStore.getPasswordHash(username);

        if (storedHash == null) {
            // Constant-time fake check to prevent timing attacks
            PasswordHasher.verify(password, DUMMY_HASH);
            return false;
        }

        // Verify password against securely stored hash
        return PasswordHasher.verify(password, storedHash);
    }

    public Connection getDatabaseConnection() throws SQLException {
        // Fixed: Retrieve credentials from secrets manager
        DatabaseCredentials creds = secretsManager.getDatabaseCredentials("myapp-db");

        String url = "jdbc:mysql://localhost:3306/myapp";
        return DriverManager.getConnection(url, creds.getUsername(), creds.getPassword());
    }

    public void callExternalService() {
        // Fixed: Retrieve API key from secure storage
        String apiKey = secretsManager.getSecret("external-api-key");

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.service.com/data"))
            .header("Authorization", "Bearer " + apiKey)
            .build();
        // Send request...
    }

    public byte[] encryptData(byte[] data) {
        // Fixed: Key retrieved from secure key store
        SecretKey key = keyStore.getKey("data-encryption-key");
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        return cipher.doFinal(data);
    }
}

// Secure initialization during setup
public class SetupWizard {

    public void initialSetup() {
        // Require admin to set unique password during setup
        String adminPassword = promptForPassword("Enter admin password: ");

        // Validate password strength
        if (!PasswordPolicy.isStrong(adminPassword)) {
            throw new SecurityException("Password does not meet requirements");
        }

        // Store hashed password
        String hash = PasswordHasher.hash(adminPassword);
        credentialStore.storePasswordHash("admin", hash);

        // Clear password from memory
        Arrays.fill(adminPassword.toCharArray(), '\0');
    }
}

# Fixed: Configuration references secrets, doesn't contain them
# config.yaml
database:
  credentials_secret: "db-credentials"  # Reference to secrets manager
  host: localhost
  port: 3306

external_api:
  key_secret: "external-api-key"  # Reference to secrets manager

The fix uses external secrets managers, prompts for credentials during setup, stores password hashes instead of plaintext, and never embeds credentials in code or configuration.

Exploited in the Wild

Mirai Botnet IoT Exploitation (Global, 2016)

The Mirai botnet exploited hard-coded default credentials in IoT devices including cameras, routers, and DVRs to build a massive botnet. The malware contained a list of 62 common username/password combinations hard-coded into various devices. Mirai-infected devices launched record-breaking DDoS attacks against major internet infrastructure, demonstrating the catastrophic impact of hard-coded credentials in deployed devices.

https://www.wired.com/story/mirai-botnet-ddos-attack-how-it-worked/

Cisco Hard-coded Credentials (Multiple Products, 2018-2022)

Multiple Cisco products including network management systems, video surveillance systems, and IoT gateways were found to contain hard-coded credentials. CVE-2022-29964 affected distributed control systems with hard-coded passwords enabling local shell access. These vulnerabilities affected critical infrastructure and required emergency patches.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory

Zyxel Firewall Backdoor (Zyxel, 2020)

CVE-2020-29583 revealed a hard-coded credential vulnerability in Zyxel firewalls and access point controllers. The undocumented account "zyfwp" had a hard-coded password that provided administrator access over SSH. Over 100,000 devices were potentially affected, and the vulnerability was actively exploited in the wild.

https://www.zyxel.com/support/CVE-2020-29583.shtml

Tools to Test/Exploit

Gitleaks — Detects hard-coded secrets, passwords, and API keys in git repositories.
TruffleHog — Searches git repositories for accidentally committed secrets and credentials.
Credential Scanner — Microsoft tool for detecting credentials in source code and configuration files.

CVE Examples

CVE-2022-29964 — Distributed Control System contained hard-coded passwords enabling local shell access.
CVE-2021-37555 — IoT pet feeder exposed hard-coded authentication credentials via Telnet service.
CVE-2021-35033 — WiFi router firmware contained hard-coded BusyBox shell password.
CVE-2020-29583 — Zyxel firewall contained undocumented hard-coded admin account.

References

MITRE Corporation. "CWE-259: Use of Hard-coded Password." Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/259.html
OWASP Foundation. "Credential Management Cheat Sheet." https://cheatsheetseries.owasp.org/cheatsheets/Credential_Management_Cheat_Sheet.html
CISA. "Alert on Default Credentials." https://www.cisa.gov/news-events/alerts
NIST. "Digital Identity Guidelines." Special Publication 800-63B. https://pages.nist.gov/800-63-3/sp800-63b.html