Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2021-34565CRITICALIn WirelessHART-Gateway versions 3.0.7 to 3.0.9 hard-coded credentials have been foundEPSS 1.0%CVE-2021-0248CRITICALNFX Series: Hard-coded credentials allow an attacker to take control of any instance through administrative interfaces.EPSS 1.0%CVE-2021-33016CRITICALKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 1.0%CVE-2024-24681CRITICALAn issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).EPSS 1.0%CVE-2023-37286CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 1EPSS 1.0%CVE-2022-23402—The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 aEPSS 1.0%CVE-2017-13106—Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13108—DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13102—Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13100—DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13101—Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2017-13104—Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryptionEPSS 1.0%CVE-2022-26671HIGHTAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded CredentialsEPSS 1.0%CVE-2018-0039MEDIUMContrail Service Orchestration: Hardcoded credentials for Grafana serviceEPSS 1.0%CVE-2023-33236CRITICALMXsecurity Hardcoded Credential VulnerabilityEPSS 1.0%CVE-2022-21194—The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUMEPSS 1.0%CVE-2026-67614CRITICALCyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminalEPSS 1.0%CVE-2020-3318HIGHCisco Firepower Management Center Static Credential VulnerabilitiesEPSS 1.0%CVE-2023-25187MEDIUMAn issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factEPSS 1.0%CVE-2017-13107—Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryptionEPSS 1.0%