Weaknesses of type CWE-321

423 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2023-20016MEDIUMCisco FXOS Software and UCS Manager Software Configuration Backup Static Key VulnerabilityEPSS 0.1%CVE-2026-2103HIGHUse of Hard-Coded Cryptographic Key for Password StorageEPSS 0.1%CVE-2026-5455MEDIUMDialogue App ca.diagram.dialogue config.json hard-coded keyEPSS 0.1%CVE-2026-5456MEDIUMAlign Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded keyEPSS 0.1%CVE-2025-4876MEDIUMHardcoded Key Revealed in ConnectWise Password Encryption UtilityEPSS 0.1%CVE-2026-5420LOWShinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded keyEPSS 0.1%CVE-2026-5310LOWEnter Software Iperius Backup IperiusAccounts.ini hard-coded keyEPSS 0.1%CVE-2026-39810MEDIUMA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosEPSS 0.1%CVE-2026-0754HIGHSIP Service Providers – Possible Impersonation of Poly Voice DeviceEPSS 0.1%CVE-2026-50606LOWHard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense SoftwareEPSS 0.1%CVE-2026-50603MEDIUMHard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSenseEPSS 0.1%CVE-2026-44278LOWA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions EPSS 0.1%CVE-2026-34499HIGHUse of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issuEPSS 0.1%CVE-2026-71456HIGHUse of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affEPSS 0.1%CVE-2025-52601MEDIUMHardcoding sensitive informationEPSS 0.1%CVE-2026-39031MEDIUMLansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-charactEPSS 0.1%CVE-2026-32324HIGHAnviz CX7 Firmware Use of Hard-coded Cryptographic KeyEPSS 0.1%CVE-2026-94591HIGHArmatura LLC Armatura One Use of Hard-coded Cryptographic KeyEPSS 0.1%CVE-2026-11347HIGHHardcoded Cryptographic Keys and Weak IV Generation in linqiEPSS 0.1%CVE-2025-58740HIGHHardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector CaptureEPSS 0.1%