Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-30234HIGHSmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a DebEPSS 0.3%CVE-2025-58069MEDIUMAutomationDirect CLICK PLUS Use of Hard-coded Cryptographic KeyEPSS 0.3%CVE-2025-10080LOWrunning-elephant Datart API AESUtil.java getTokensecret hard-coded keyEPSS 0.3%CVE-2025-1099HIGHInformation Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi CameraEPSS 0.3%CVE-2026-5622MEDIUMhcengineering Huly Platform JWT Token token.ts hard-coded keyEPSS 0.3%CVE-2025-24525HIGHKeysight Ixia Vision Product Family Use of Hard-coded Cryptographic KeyEPSS 0.3%CVE-2026-18154HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-9604MEDIUMcoze-studio aes.go hard-coded keyEPSS 0.3%CVE-2020-25688—A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certifEPSS 0.3%CVE-2025-31362LOWUse of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption EPSS 0.3%CVE-2026-49006MEDIUMTLS credential leakage vulnerability in ZTE F689 productEPSS 0.2%CVE-2026-6611LOWliangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded keyEPSS 0.2%CVE-2025-10250LOWDJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded keyEPSS 0.2%CVE-2021-43587HIGHDell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malEPSS 0.2%CVE-2026-34635HIGHColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)EPSS 0.2%CVE-2025-62841HIGHHard-coded Cryptographic Key #2EPSS 0.2%CVE-2026-112345HIGHTTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key ExposureEPSS 0.2%CVE-2026-53939CRITICALOpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryptionEPSS 0.2%CVE-2025-62839HIGHHard-coded Cryptographic Key #1EPSS 0.2%CVE-2026-33362HIGHMeari SDK hardcoded cryptographic keysEPSS 0.2%