Hardcoded Credentials
Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.
Definition
Hardcoded credentials are authentication secrets - passwords, API keys, private keys, service tokens - embedded directly in firmware, binaries, or source code distributed across every unit of a device family. Because the secret is identical on every device, a single firmware extraction or source leak compromises the entire fleet. Hardcoded credentials have driven multiple high-profile FDA safety communications (Hospira infusion pumps, St. Jude implantables, GE imaging consoles) and remain a top finding in MedTech penetration tests.What this means in practice
Eliminating hardcoded credentials means every device must provision its own unique key material at manufacture (often via a hardware secure element), or pull a unique credential from an authenticated bootstrap service on first boot. Service accounts that need credentials should rotate them through a secrets manager rather than embedding static values.- •Burning the same SSH or web-admin password into every shipped device.
- •Embedding cloud API keys in mobile companion apps - they can be extracted by anyone with the app binary.
- •Using a 'default password that the user must change' that, in practice, no one changes.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsHands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device.
More in Cybersecurity
· Same categoryA structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Where this term appears across MedTech Terms.
Primary references
3 sources- 1
CWE-798 Use of Hard-coded CredentialsVerifiedMITREcwe.mitre.org
- 2
FDA Cybersecurity Guidance (Sept 2023)VerifiedFDAfda.gov
- 3
CISA - Healthcare and Public Health SectorVerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.