Weaknesses of type CWE-321

317 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-30406CRITICALGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'EPSS 93.8%KEVCVE-2016-4437CRITICALApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitEPSS 93.0%KEVCVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-27584CRITICALDragonfly2 vulnerable to hard coded cyptographic keyEPSS 33.6%CVE-2020-10884HIGHThis vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190EPSS 24.7%CVE-2021-4228MEDIUMHard-coded TLS CertificateEPSS 9.9%CVE-2026-62241CRITICALclawvet < 0.7.5 Hard-coded JWT Secret Session ForgeryEPSS 6.5%CVE-2019-10963—Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maEPSS 6.5%CVE-2022-1701—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.EPSS 4.6%CVE-2020-6990CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 4.4%CVE-2020-1764HIGHA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atEPSS 3.5%CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.1%CVE-2026-26335CRITICALCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEEPSS 2.8%CVE-2025-13316HIGHHard-coded encryption keys in Twonky ServerEPSS 2.7%CVE-2014-5419—GE Multilink Use of Hard-coded Cryptographic KeyEPSS 2.4%CVE-2021-40119CRITICALCisco Policy Suite Static SSH Keys VulnerabilityEPSS 2.4%CVE-2019-5137HIGHThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fEPSS 2.3%CVE-2017-6054—A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-cEPSS 2.1%CVE-2025-57174CRITICALAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoEPSS 2.1%CVE-2017-14021—A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-EPSS 1.9%