Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-80114HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sysEPSS 0.2%CVE-2026-87424HIGHA vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentEPSS 0.2%CVE-2026-65198HIGHHuawei Default SNMPv3 USM keyEPSS 0.2%CVE-2026-50226MEDIUMFirmware Theft & IMEI Spoofing via Connect-OTAEPSS 0.2%CVE-2025-40946HIGHA vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 1EPSS 0.2%CVE-2025-43483MEDIUMPoly Clariti Manager - Multiple Security VulnerabilitiesEPSS 0.2%CVE-2020-25231—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). TEPSS 0.2%CVE-2025-32730MEDIUMUse of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance caEPSS 0.2%CVE-2026-82154LOWDell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker witEPSS 0.2%CVE-2026-1442HIGHUnitree UPK files Hard-Coded KeyEPSS 0.2%CVE-2023-20038HIGHA vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a EPSS 0.2%CVE-2022-34386MEDIUM Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographEPSS 0.2%CVE-2024-56429HIGHitech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to tEPSS 0.2%CVE-2026-109813HIGHShared Hard-coded Root CA Private KeyEPSS 0.2%CVE-2026-75558MEDIUMBotslab G980H Dashcams Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2026-5462MEDIUMWahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded keyEPSS 0.2%CVE-2024-54027HIGHA Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.EPSS 0.2%CVE-2025-6666LOWmotogadget mo.lock Ignition Lock NFC hard-coded keyEPSS 0.2%CVE-2026-64887HIGHAirwall - Hardcoded SecretsEPSS 0.2%CVE-2024-47256MEDIUMSuccessful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passEPSS 0.2%