Weaknesses of type CWE-321

361 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-54471MEDIUMNeuVector is shipping cryptographic material into its binaryEPSS 0.2%CVE-2025-10250LOWDJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded keyEPSS 0.2%CVE-2025-9604MEDIUMcoze-studio aes.go hard-coded keyEPSS 0.2%CVE-2025-31362LOWUse of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption EPSS 0.2%CVE-2026-33362HIGHMeari SDK hardcoded cryptographic keysEPSS 0.2%CVE-2025-6071MEDIUMHard Coded Key used for AES encryptionEPSS 0.2%CVE-2026-45041HIGHRustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgeryEPSS 0.2%CVE-2021-43587HIGHDell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malEPSS 0.2%CVE-2026-33266HIGHApache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltEPSS 0.2%CVE-2019-19754MEDIUMHiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes iEPSS 0.2%CVE-2026-9260MEDIUMUse of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierEPSS 0.2%CVE-2026-14804CRITICALHardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2026-18330MEDIUMHardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4EPSS 0.2%CVE-2025-36326LOWIBM Controller information disclosureEPSS 0.2%CVE-2026-32958MEDIUMSD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apEPSS 0.2%CVE-2026-76847HIGHact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 BackendEPSS 0.2%CVE-2025-12177MEDIUMDownload Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron KeyEPSS 0.2%CVE-2025-68948MEDIUMSiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session SecretEPSS 0.2%CVE-2024-50564LOWA use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all veEPSS 0.2%CVE-2026-42518HIGHInformation Disclosure Vulnerability in e-Sushrut HMISEPSS 0.2%