Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2017-6054—A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-cEPSS 2.1%CVE-2017-14021—A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-EPSS 1.9%CVE-2022-0664HIGHUse of Hard-coded Cryptographic Key in gravitl/netmakerEPSS 1.7%CVE-2014-5403—Hospira MedNet Use of Hard-coded Cryptographic KeyEPSS 1.7%CVE-2022-24860HIGHDatabasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.EPSS 1.7%CVE-2022-23650HIGHUse of Hard-coded Cryptographic Key in NetmakerEPSS 1.6%CVE-2016-9335—A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware VersionEPSS 1.5%CVE-2019-10920—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which isEPSS 1.5%CVE-2020-6979—In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibilitEPSS 1.5%CVE-2020-6983—In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-cEPSS 1.5%CVE-2018-0040CRITICALContrail Service Orchestration: hardcoded cryptographic certificates and keysEPSS 1.4%CVE-2022-29830CRITICALUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control SettinEPSS 1.4%CVE-2019-10990MEDIUMRed Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected fEPSS 1.3%CVE-2017-7574CRITICALSchneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. TheEPSS 1.3%CVE-2019-13929—A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1EPSS 1.3%CVE-2023-39482MEDIUMSofting Secure Integration Server Hardcoded Cryptographic Key Information Disclosure VulnerabilityEPSS 1.2%CVE-2022-22987CRITICALAdvantech ADAM-3600EPSS 1.2%CVE-2022-29186CRITICALUse of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterpriseEPSS 1.2%CVE-2020-28395—A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 andEPSS 1.2%CVE-2021-27392—A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), SivEPSS 1.2%