Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-12177MEDIUMDownload Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron KeyEPSS 0.2%CVE-2026-45041HIGHRustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgeryEPSS 0.2%CVE-2026-89052MEDIUMHardcoded AES encryption key in Archer C6EPSS 0.2%CVE-2026-82929MEDIUMUse of Shared Cryptographic Key in mH-DEVELOPEREPSS 0.2%CVE-2026-106172MEDIUMA use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSanEPSS 0.2%CVE-2019-19754MEDIUMHiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes iEPSS 0.2%CVE-2026-9260MEDIUMUse of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlierEPSS 0.2%CVE-2025-52374MEDIUMUse of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other serverEPSS 0.2%CVE-2026-105330—Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessEPSS 0.2%CVE-2026-32958MEDIUMSD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apEPSS 0.2%CVE-2025-36326LOWIBM Controller information disclosureEPSS 0.2%CVE-2025-30198LOWECOVACS Vacuum and Base Station Hard-Coded WPA2-PSKEPSS 0.2%CVE-2021-43552MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2026-108336CRITICALToken Signing Key Allows Unauthenticated Administrative AccessEPSS 0.2%CVE-2025-68948MEDIUMSiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session SecretEPSS 0.2%CVE-2026-102241MEDIUMNetcore NAP930 Backup/Restore backup_common.sh hard-coded keyEPSS 0.2%CVE-2024-50564LOWA use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all veEPSS 0.2%CVE-2026-42518HIGHInformation Disclosure Vulnerability in e-Sushrut HMISEPSS 0.2%CVE-2026-4477LOWYi Technology YI Home Camera WPA/WPS hard-coded keyEPSS 0.2%CVE-2026-32644CRITICALMilesight Cameras Use of Hard-coded Cryptographic KeyEPSS 0.2%