Weaknesses of type CWE-321

427 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2022-34425HIGHDell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentialEPSS 0.9%CVE-2025-30206CRITICALDpanel's hard-coded JWT secret leads to remote code executionEPSS 0.9%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%CVE-2024-1631CRITICALagent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`EPSS 0.9%CVE-2021-0266HIGHcSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.EPSS 0.9%CVE-2020-25193MEDIUMGE Reason RT43X Clocks Use of Hard-coded Cryptographic KeyEPSS 0.9%CVE-2026-25894CRITICALFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationEPSS 0.8%CVE-2024-30207CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.8%CVE-2021-22644HIGHOvarro TBox Use of Hard-coded Cryptographic KeyEPSS 0.8%CVE-2022-1400HIGHHardcoded encryption key IV in Exago WebReportsApi.dllEPSS 0.8%CVE-2023-34123—Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versiEPSS 0.8%CVE-2026-25505CRITICALBambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require AuthenticationEPSS 0.8%CVE-2026-35019CRITICALNetComm NF20MESH < R6B032 Hardcoded AES Key Authentication BypassEPSS 0.8%CVE-2022-20868MEDIUMA vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco SecureEPSS 0.8%CVE-2025-5164MEDIUMPerfreeBlog JWT JwtUtil hard-coded keyEPSS 0.8%CVE-2026-90945CRITICALCrawlab through 0.6.3 Authentication Bypass via Hard-coded JWT SecretEPSS 0.8%CVE-2023-3632CRITICALHard-coded Cryptographic Key in Kunduz - Homework Helper AppEPSS 0.8%CVE-2023-39465HIGHTriangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-22844HIGHAn authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-craftEPSS 0.8%