Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-4477LOWYi Technology YI Home Camera WPA/WPS hard-coded keyEPSS 0.2%CVE-2026-32644CRITICALMilesight Cameras Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2025-48417MEDIUMHard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stationsEPSS 0.2%CVE-2026-5846HIGHHard-coded Cryptographic Key in Watchfire ControllersEPSS 0.2%CVE-2026-27519HIGHBinardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption KeyEPSS 0.2%CVE-2022-34462HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge ofEPSS 0.2%CVE-2025-14923MEDIUMIBM WebSphere Application Server Liberty could provide weaker than expected securityEPSS 0.2%CVE-2023-2637HIGHRockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic KeyEPSS 0.2%CVE-2024-31410HIGHCyberPower PowerPanel business Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2026-105035HIGHEnergizeLab FirmwareUpdater Universal Hard-Coded AES KeyEPSS 0.2%CVE-2020-25233—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices conEPSS 0.2%CVE-2025-63289CRITICALSogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encrypEPSS 0.2%CVE-2025-30239HIGHSensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet DevicesEPSS 0.2%CVE-2026-11505LOWGL.iNet XE3000 glnassys hard-coded keyEPSS 0.2%CVE-2026-66763HIGHCredentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)EPSS 0.2%CVE-2024-20323HIGHA vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection betwEPSS 0.2%CVE-2025-60250MEDIUMUnitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 284EPSS 0.2%CVE-2026-10764HIGHInformation disclosure in BVMS 4.5 up to 12.3EPSS 0.2%CVE-2024-38532HIGHTEST_KEY used in example dcp_tool reference implementationEPSS 0.2%