CVE-2022-37857

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-side as well as in clear-text on the android client device by default.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312 CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/Third Party Advisory
https://github.com/bilde2910/Hauk/issues/187Issue Tracking, Third Party Advisory
https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/Third Party Advisory
https://github.com/bilde2910/Hauk/issues/187Issue Tracking, Third Party Advisory

Timeline

Published: Sep 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-37867.5A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after c CVE-2022-378609.8The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection v CVE-2022-378619.8There is a remote code execution (RCE) vulnerability in Tenhot TWS-100 V4.0-201809201424 router device. It is necessary to know that the dev CVE-2022-378647.8A vulnerability has been identified in Solid Edge (All Versions < SE2022MP9). The affected application contains an out of bounds write past CVE-2022-378659.1With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack2 CVE-2022-378667.5When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may in CVE-2022-37877.8A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited al CVE-2022-378777.8A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A suc CVE-2022-378787.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378797.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378807.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2022-378817.2Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on