Cyber Resilience

CWE · MITRE source

CWE-259Use of Hard-coded Password

Abstraction: Variant · CVEs in our corpus: 199

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

There are two main variations of a hard-coded password:

Last updated: 22 August 2026 14:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-5 Authenticator Management
  • PM-16 Threat Awareness Program
  • SA-21 Developer Screening
  • SR-6 Supplier Assessments and Reviews
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (4)AI-assisted

Control Title Family Why it addresses this CWE
IA-5Authenticator ManagementIAChanging default authenticators prior to first use directly prevents use of hard-coded passwords.
PM-16Threat Awareness ProgramPMShared threat data frequently highlights products or deployments still using hard-coded passwords, enabling remediation that directly blocks credential-based attacks.
SA-21Developer ScreeningSABackground checks and authorization requirements decrease the probability that a developer will hard-code passwords for later unauthorized access.
SR-6Supplier Assessments and ReviewsSRReviews of supplier deliverables reduce the chance that hard-coded passwords are introduced into the system.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-7332 8.69.80.20742024-08-01
CVE-2023-2645 7.89.80.03152023-05-11
CVE-2025-8730 7.89.80.03242025-08-08
CVE-2016-9358 7.79.80.02132017-06-30
CVE-2015-3953 7.79.80.01972019-03-25
CVE-2017-6022 7.69.80.01752017-06-30
CVE-2014-5434 7.69.80.01562019-03-26
CVE-2020-12016 7.69.80.01862020-06-29
CVE-2020-12045 7.69.80.01682020-06-29
CVE-2020-12047 7.69.80.01682020-06-29
CVE-2021-27440 7.69.80.01352021-03-25
CVE-2021-22729 7.69.80.01762021-07-21
CVE-2022-45444 7.610.00.00942023-01-18
CVE-2019-10881 7.59.80.00992021-04-13
CVE-2021-38456 7.59.80.01182021-10-12
CVE-2021-34601 7.59.80.01042022-04-27
CVE-2017-20039 7.59.80.01192022-06-11
CVE-2022-30271 7.59.80.00982022-07-26
CVE-2022-22144 7.59.80.00942022-08-05
CVE-2023-5222 7.56.30.74522023-09-27
CVE-2024-32741 7.510.00.00632024-05-14
CVE-2024-4708 7.59.80.01002024-07-02
CVE-2023-46685 7.59.80.01002024-07-08
CVE-2024-36526 7.59.80.00882024-07-09
CVE-2025-27638 7.59.80.00872025-03-05