Hardcoded Credentials
Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.
Definition
Hardcoded credentials are authentication secrets - passwords, API keys, private keys, service tokens - embedded directly in firmware, binaries, or source code distributed across every unit of a device family. Because the secret is identical on every device, a single firmware extraction or source leak compromises the entire fleet. Hardcoded credentials have driven multiple high-profile FDA safety communications (Hospira infusion pumps, St. Jude implantables, GE imaging consoles) and remain a top finding in MedTech penetration tests.What this means in practice
Eliminating hardcoded credentials means every device must provision its own unique key material at manufacture (often via a hardware secure element), or pull a unique credential from an authenticated bootstrap service on first boot. Service accounts that need credentials should rotate them through a secrets manager rather than embedding static values.Examples
- An administrator password, pre-set to 'admin123' at the factory, is embedded in the software of every monitoring system, allowing unauthorized access if discovered.
- A shared API key for a cloud service is hardcoded into the firmware of diagnostic equipment, meaning compromise of one device exposes the key for all identical units.
- A private cryptographic key, essential for secure communication, is identical in the source code of every networked therapy device, making it a single point of failure for fleet security.
- •Burning the same SSH or web-admin password into every shipped device.
- •Embedding cloud API keys in mobile companion apps - they can be extracted by anyone with the app binary.
- •Using a 'default password that the user must change' that, in practice, no one changes.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsHands-on adversarial testing in which qualified independent testers attempt to exploit a device's security controls.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device.
More in Cybersecurity
· Same categoryA structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1CWE-798 Use of Hard-coded CredentialsTier 2 VerifiedMITREcwe.mitre.org
- 2FDA Cybersecurity Guidance (Sept 2023)Tier 2 VerifiedFDAfda.gov
- 3CISA - Healthcare and Public Health SectorTier 2 VerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.