Fallos del tipo CWE-259

195 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2023-5222MEDIUMViessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded passwordEPSS 74.5%CVE-2024-7332CRITICALTOTOLINK CP450 Telnet Service product.ini hard-coded passwordEPSS 20.7%CVE-2012-5862—Sinapsi eSolar Hard-Coded PasswordEPSS 11.9%CVE-2023-51629MEDIUMD-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass VulnerabilityEPSS 3.9%CVE-2025-8730CRITICALBelkin F9K1009/F9K1010 Web Interface hard-coded credentialsEPSS 3.2%CVE-2023-2645CRITICALUSR USR-G806 Web Management Page hard-coded passwordEPSS 3.2%CVE-2025-57788MEDIUMUnauthorized API Access RiskEPSS 2.8%CVE-2014-5405—Hospira MedNet Use of Hard-coded PasswordEPSS 2.3%CVE-2016-9358—A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32EPSS 2.1%CVE-2014-2363—Morpho Itemiser 3 Hard-Coded CredentialEPSS 2.1%CVE-2015-3953—Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 2.0%CVE-2020-12016—Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,EPSS 1.9%CVE-2019-3908—Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An aEPSS 1.8%CVE-2021-22729—A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink PEPSS 1.8%CVE-2017-6022—A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA JourEPSS 1.8%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-21818HIGHA hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted netEPSS 1.7%CVE-2020-12047—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-defaEPSS 1.7%CVE-2020-12045—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opEPSS 1.7%CVE-2014-5434—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account withEPSS 1.6%