Weaknesses of type CWE-321

360 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2026-31986CRITICALApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionEPSS 0.4%CVE-2026-5527MEDIUMTenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded keyEPSS 0.4%CVE-2019-19753CRITICALSimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes idEPSS 0.4%CVE-2023-42492HIGH EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2024-20350HIGHCisco Catalyst Center Static SSH Host Key VulnerabilityEPSS 0.4%CVE-2022-34442HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker wiEPSS 0.4%CVE-2026-78225CRITICALWärtsilä FOS-Onboard Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2025-34234CRITICALVasion Print (formerly PrinterLogic) Hardcoded Encryption Private KeysEPSS 0.4%CVE-2025-55619CRITICALReolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulEPSS 0.4%CVE-2025-67112CRITICALUse of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) EPSS 0.4%CVE-2025-11290MEDIUMCRMEB JWT HMAC Secret hard-coded keyEPSS 0.4%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2023-3947LOWVideo Conferencing with Zoom <= 4.2.1 - Sensitive Information ExposureEPSS 0.4%CVE-2026-5549MEDIUMTenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded keyEPSS 0.4%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.4%CVE-2026-9220HIGHSetracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic keyEPSS 0.4%CVE-2017-14014—Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removablEPSS 0.4%CVE-2025-34211CRITICALVasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private KeysEPSS 0.4%CVE-2025-6669MEDIUMgooaclok819 sublinkX jwt.go hard-coded keyEPSS 0.4%CVE-2025-12615LOWPHPGurukul News Portal settings.py hard-coded keyEPSS 0.4%