Weaknesses of type CWE-321

421 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-64304MEDIUM"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.EPSS 0.1%CVE-2025-30200LOWECOVACS Vacuum and Base Station Hard-Coded AES EncryptionEPSS 0.1%CVE-2026-80057MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-78487MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-80167MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2025-56802MEDIUMThe Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers EPSS 0.1%CVE-2023-6482MEDIUMEncryption key derived from static host informationEPSS 0.1%CVE-2025-2810MEDIUMDraeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic KeyEPSS 0.1%CVE-2026-107171MEDIUMAn Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.EPSS 0.1%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%CVE-2025-26476HIGHDell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticEPSS 0.1%CVE-2026-25107MEDIUMELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knEPSS 0.1%CVE-2026-91912HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attackeEPSS 0.1%CVE-2022-36925MEDIUMInsecure key generation for Zoom Rooms for macOS ClientsEPSS 0.1%CVE-2026-34029MEDIUMHard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration dataEPSS 0.1%CVE-2026-102812MEDIUMHardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7EPSS 0.1%CVE-2026-79762MEDIUMTermix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copyEPSS 0.1%CVE-2026-34022HIGHWeak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryptionEPSS 0.1%CVE-2026-6787HIGHUsage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing processEPSS 0.1%CVE-2024-20280MEDIUMCisco UCS Central Software Configuration Backup Static Key VulnerabilityEPSS 0.1%