All news with #hardcoded credentials tag

🔒 SAP disclosed a critical flaw in its Cloud SDK for Python that could expose an application's OAuth2 client credentials if an attacker controls a tenant subdomain. The issue, tracked as CVE-2026-89111 with a CVSS score of 10.0, stems from missing validation of tenant subdomain values in several releases. SAP fixed the defect in version 0.45.2, and later releases reintroduced and then remedied the omission; users are advised to upgrade or validate tenant names before calling the SDK.

🔒 Unit 42 researchers found that default AWS AgentCore Harness configurations can enable prompt-injection attacks that cause the harness to exfiltrate plaintext credentials from AgentCore Identity. The harness ships built-in tools, including a root-running shell enabled by default, which can access credentials when they are resolved to memory. AWS closed the report as informative under the shared responsibility model; operators should scope allowedTools, apply least privilege to identity vault accounts, and monitor egress from harness containers. Unit 42 offers cloud assessments and incident response support.

📰 This week's ThreatsDay Bulletin tracks diverse attack trends where keys and secrets are repeatedly exposed across AI tools, internet-facing services, old vulnerabilities, and weak credentials. Highlights include a PPI malware marketplace delivering cross-platform RATs, widespread compromise of unauthenticated LocalAI instances, and research showing AI agents can retrain and replace their own models. Additional items cover ransomware exploiting VMware, Oracle's large September patch update, insider SIM-swap convictions, RF side-channel leaks, and resurgence of Cyclops Blink on Cisco FMC.

🔒 Coder disclosed that an attacker gained access to its Cloudflare-backed registry infrastructure and added unauthorized IPs that served a tampered copy of the project's package registry. Between 07:35 UTC and 21:45 UTC on August 31, some requests were routed to attacker-controlled servers that delivered modified Terraform modules containing credential-stealing code. The malicious modules searched for a wide range of secrets and exfiltrated data to a lookalike domain; Coder advises rotating affected secrets, examining logs, and purging cached packages prior to upgrading to patched releases.

🔒 TP-Link patched 15 vulnerabilities in the Omada zero-touch provisioning (ZTP) mechanism that could be chained with earlier flaws to achieve remote code execution and full network compromise. Forescout’s Vedere Labs disclosed the issues at Black Hat USA, noting impacts across Omada controllers, gateways, switches, access points, cloud services, mobile apps, and various TP-Link devices. The flaws include hard-coded keys, information disclosure, device hijacking, client-side code execution, and interception of encrypted communications. Administrators are urged to apply firmware updates, use strong unique credentials, enable MFA, rotate secrets if compromise is suspected, and monitor for suspicious activity.

🔒 Cisco warns that a high-severity static credential flaw in Secure Firewall Management Center (FMC)—tracked as CVE-2026-20316—has been actively exploited in zero-day attacks to gain unauthorized access. The flaw stems from built-in static credentials for a low-privilege account, enabling unauthenticated remote login and access to account data. Cisco released hot fixes for multiple FMC releases and advises installing them immediately, noting no effective workarounds and recommending credential rotation if compromise is detected.

🔒 CERT/CC warns that an undocumented authentication backdoor in multiple Tenda router firmware versions (CVE-2026-11405) can grant administrative access via an alternate plaintext password stored in sys.rzadmin.password. The backdoor bypasses normal MD5 authentication in the '/bin/httpd' login() function, accepting any username if the backdoor password is supplied. No patch is available and Tenda could not be reached; users are advised to disable remote web management and restrict LAN exposure.

🛠️ Independent researcher Andreas Makris discovered a universal hardcoded root password and permanent remote-access mechanism in Yarbo robotic mowers that allowed him to control thousands of units remotely. He demonstrated the flaw by hijacking a mower in the U.S. from Germany, showing how attackers could steer the machine, access cameras, and extract owner data. Yarbo has issued updates and plans to make remote access opt-in, but owners should install patches and follow basic IoT security hygiene.

🔒 Yarbo mobile apps and cloud infrastructure expose hard-coded MQTT broker credentials and lack per-device authorization, enabling broad access to telemetry and command topics across the robot fleet. The vulnerability allows wildcard subscription to telemetry and publishing to individual robot command topics using only a serial number. Yarbo recommends updating the mobile app to 3.17.4 or later; server-side broker authorization will be enforced with the May 2026 update. CISA advises network restrictions, isolation behind firewalls, and use of secure remote access methods while organizations perform risk assessments.

🔒 KACO blueplanet inverters contain vulnerabilities that can expose service credentials and allow SQL injection against management components. Siemens and KACO new energy have released updates for some models and recommend updating to the latest firmware where fixes exist. Operators should minimize network exposure, segment control networks, and apply vendor security updates after validation and supervised deployment.

🔒 CISA warns that ongoing cyber-attacks on automated tank gauges (ATGs) could allow attackers to drain fuel tanks or hide theft and leaks, affecting gas stations, military bases, hospitals, and industrial sites. The attacks exploit authentication bypasses, hardcoded credentials, OS command execution, SQL injection, and privilege escalation to gain full control. Administrators are urged to remove public serial connections, change default passwords, apply patches, report incidents to CISA, and push supply-chain partners to adopt defenses.

🔒 NAVTOR NavBox through version 4.16.1.20 contained hard-coded credentials in its Windows Communication Foundation (SOAP) implementation. If SOAP is enabled, a local attacker could extract those credentials to authenticate to privileged WCF methods and write or overwrite files within application-defined paths, disrupting operations. NAVTOR released a patch in April 2026; versions 4.17.2.6 and later include the fix, and connected NavBox users will be updated automatically.

🔒 CISA reports critical vulnerabilities in the XCharge C6 electric vehicle charging controller that could allow attackers to gain administrator rights or execute arbitrary code. A firmware update mechanism lacks signature validation, a stack-based buffer overflow exists in signal processing, and a management service exposes default credentials over the charging interface. XCharge has deployed updates for affected units; users should contact XCharge Support for details.

🔒 The USR-W610 RS232/485 to Wi‑Fi/Ethernet Converter from Jinan USR IOT Technology Limited contains plaintext administrative credentials embedded in its firmware. These hard-coded credentials can be extracted through firmware analysis and used to authenticate to device services, enabling potential administrator access. CISA reports no confirmed public exploitation and encourages users to contact the vendor and apply updates where available. Mitigations include network segmentation, firewalling, and using secure remote access methods such as VPNs with current updates.

🔒 The MacGregor Voyage Data Recorder (VDR) G4e contains multiple credential management vulnerabilities, including default and hard-coded credentials, weak password hashing, and accessible authentication files that can allow an attacker to gain administrator access. Danelec has released firmware V5.250 to address these issues and users are urged to update at the next service attendance rather than waiting for annual maintenance. CISA recommends minimizing network exposure, isolating control networks behind firewalls, and using secure remote access methods such as up-to-date VPNs while performing risk assessments prior to deployment of mitigations.

🔒 ABB disclosed a vulnerability in MConfig affecting versions listed by the vendor that allows sensitive data to be stored in cleartext in memory. An attacker with physical or local host access could export a memory dump that may include plaintext passwords. ABB released MConfig version 1.4.9.22 to remediate the issue and recommends applying defensive measures from the product manual.

🔒 The Eppendorf BioFlo 320 is affected by a high‑severity vulnerability (CVSS 9.8) due to a VNC server that uses a hard‑coded password. If remote access is enabled and an attacker knows the device's network address, they can gain full control of the controller interface; VNC traffic is unencrypted. Eppendorf has released Version 5.0 software that removes VNC access and urges users to verify VNC is disabled and restrict configuration changes to Admin and Supervisor roles.

🔒 A public GitHub repository tied to a suspected CISA contractor exposed plain-text credentials—AWS tokens, GitHub access tokens, Kubernetes files, workflows and internal documents—discovered on May 14 by GitGuardian. The repo, active since November 13, 2025, contained roughly 844 MB of data and was taken offline within a day after disclosure. CISA is investigating and reports no current indication of sensitive compromise. Experts recommend centralized secret management, automated secret scanning, strict vendor controls and MFA to prevent similar exposures.

🔔 Siemens disclosed multiple vulnerabilities in Teamcenter that could affect availability, integrity, and confidentiality of affected installations. The vendor published patches across several builds and recommends administrators update to the indicated fixed versions (examples include V2312.0009, V2406.0006, V2412.0009, V2506.0005 and later). Identified issues include improper error checking (CWE-754), cross-site scripting (CWE-79), and hard‑coded credentials (CWE-798). CISA and Siemens advise minimizing network exposure, isolating control systems, applying vendor updates promptly, and following Siemens' industrial security guidance.

🔒 A Norwegian researcher discovered that Microsoft Edge decrypts saved passwords at startup and keeps them resident in process memory, leaving credentials retrievable in plain text on shared or compromised machines. German publication Heise reproduced the finding, locating passwords even after a browser restart. Microsoft reportedly treats the behavior as 'by design,' prompting calls for using alternative password managers.