Weaknesses of type CWE-321

360 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-26340HIGHA CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenEPSS 1.2%CVE-2020-25180MEDIUMRockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic KeyEPSS 1.2%CVE-2025-34215CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCEEPSS 1.1%CVE-2019-19750CRITICALminerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.EPSS 1.1%CVE-2024-5296CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 1.1%CVE-2020-28391—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2023-21705HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5722HIGHLogsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution VulnerabilityEPSS 1.1%CVE-2020-7846HIGHHelpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads toEPSS 1.1%CVE-2022-29829MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOEPSS 1.1%CVE-2022-29827MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2022-29828MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2024-33891HIGHDelinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebServiceEPSS 1.0%CVE-2021-27389—A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key iEPSS 1.0%CVE-2021-32520CRITICALQSAN Storage Manager - Use of Hard-coded Cryptographic KeyEPSS 1.0%CVE-2026-5426CRITICALKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueEPSS 1.0%CVE-2023-37936CRITICALA use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 througEPSS 1.0%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2025-30206CRITICALDpanel's hard-coded JWT secret leads to remote code executionEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%