Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2026-86150MEDIUMTenda CP3 hostapd hard-coded credentialsEPSS 0.2%CVE-2025-47823LOWFlock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.EPSS 0.2%CVE-2024-33867MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.EPSS 0.2%CVE-2024-20412CRITICALA vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthEPSS 0.2%CVE-2023-1944HIGH[minikube] ssh server with default passwordEPSS 0.2%CVE-2025-9309LOWTenda AC10 MD5 Hash shadow hard-coded credentialsEPSS 0.2%CVE-2025-47821LOWFlock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.EPSS 0.2%CVE-2026-23933HIGHHardcoded session key in Zabbix 7.4EPSS 0.2%CVE-2023-23771HIGHMotorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for servicEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2025-70798HIGHTenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attaEPSS 0.2%CVE-2025-70802HIGHTenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows aEPSS 0.2%CVE-2024-28023MEDIUMA vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintEPSS 0.2%CVE-2025-7741LOWHardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used EPSS 0.2%CVE-2024-48831HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker withEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-9806LOWTenda F1202 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-9380HIGHFNKvision Y215 CCTV Camera Firmware passwd hard-coded credentialsEPSS 0.1%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2025-9731LOWTenda AC9 Administrative shadow hard-coded credentialsEPSS 0.1%