Weaknesses of type CWE-321

362 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-42518HIGHInformation Disclosure Vulnerability in e-Sushrut HMISEPSS 0.2%CVE-2026-32644CRITICALMilesight Cameras Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2025-30198LOWECOVACS Vacuum and Base Station Hard-Coded WPA2-PSKEPSS 0.2%CVE-2021-43552MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2026-18411HIGHUse of hard-coded cryptographic key in Acrisure KARR BT and DR-100EPSS 0.2%CVE-2026-13184HIGHRadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2025-48417MEDIUMHard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stationsEPSS 0.2%CVE-2023-2637HIGHRockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic KeyEPSS 0.2%CVE-2025-52374MEDIUMUse of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other serverEPSS 0.2%CVE-2024-31410HIGHCyberPower PowerPanel business Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2020-25233—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices conEPSS 0.2%CVE-2026-11505LOWGL.iNet XE3000 glnassys hard-coded keyEPSS 0.2%CVE-2022-34462HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge ofEPSS 0.2%CVE-2026-79735MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.2%CVE-2026-53939CRITICALOpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryptionEPSS 0.2%CVE-2024-20323HIGHA vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection betwEPSS 0.2%CVE-2026-78486MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.2%CVE-2025-60250MEDIUMUnitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 284EPSS 0.2%CVE-2024-38532HIGHTEST_KEY used in example dcp_tool reference implementationEPSS 0.2%