CVE-2025-34509
Use of Hard-coded Credentials: Is CVE-2025-34509 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Reported exploited in the wild (VulnCheck KEV), though not in CISA KEV yet. Treat it as urgent and check your exposure.
cisa ssvc
CISA Vulnrichment · assessed
CISA decision, by how critical the affected system is to you:
- low impact → Track
- medium impact → Track*
- high impact → Attend
Track: normal patch cycle · Track*: watch closely · Attend: patch sooner · Act: patch now. About SSVC ↗
baseline read
auto · not a community verdict
Likely real & worth prioritising
High base severity and a high real-world exploitation probability both point to a genuine, actively targeted issue.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2025-34509)<a href="https://www.truepositive.app/cve/CVE-2025-34509"><img src="https://www.truepositive.app/cve/CVE-2025-34509/badge.svg" alt="TruePositive verdict for CVE-2025-34509"></a>Live badge that updates automatically as the community verdict changes.
timeline
- Added to VulnCheck KEV · reported exploited in the wild
- CISA SSVC assessment · exploitation: poc
- Published by NVD
Score and exploit changes tracked since .
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: A curated baseline from public sources, shown separately from community verdicts.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
No confirmed in-the-wild exploitation or public exploit was found for this yet. FIRST EPSS estimates about a 56% chance of exploitation in the next 30 days, which is high relative to most CVEs. It is reachable over the network with no authentication and no user interaction, which is the most dangerous profile.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-798 · Use of Hard-coded Credentials.
- CVE-2022-26138CRIT 9.8KEVEPSS 98%
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
- CVE-2024-3272CRIT 9.8KEVEPSS 98%
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- CVE-2024-28987CRIT 9.1KEVEPSS 93%
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- CVE-2020-8657CRIT 9.8KEVEPSS 92%
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
- CVE-2025-14611CRIT 9.8KEVEPSS 53%
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
- CVE-2021-44207HIGH 8.1KEVEPSS 18%
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.