CVE-2022-37857

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-08 · updated 2026-06-17
Weakness: CWE-312

Description

bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-side as well as in clear-text on the android client device by default.

Affected products

Hauk Project Hauk: 1.6.1

References

https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/
https://github.com/bilde2910/Hauk/issues/187
https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/
https://github.com/bilde2910/Hauk/issues/187

Get alerted when CVE-2022-37857 or the next vulnerability affects your stack