Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2023-46685CRITICALA hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specEPSS 1.0%CVE-2024-4708CRITICALmySCADA myPRO Use of Hard-coded PasswordEPSS 1.0%CVE-2019-10881CRITICALDefault hidden Privileged Account Vulnerability in multiple XEROX devicesEPSS 1.0%CVE-2022-45444CRITICALCVE-2022-45444EPSS 0.9%CVE-2022-22144HIGHA hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0EPSS 0.9%CVE-2023-3237MEDIUMOTCMS hard-coded passwordEPSS 0.9%CVE-2023-32145HIGHD-Link DAP-1360 Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2024-29011HIGHUse of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlieEPSS 0.9%CVE-2025-27638CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.EPSS 0.9%CVE-2024-36526CRITICALZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.EPSS 0.9%CVE-2014-125030MEDIUMtaoeffect Empress hard-coded passwordEPSS 0.9%CVE-2018-25069HIGHNetis Netcore Router hard-coded passwordEPSS 0.9%CVE-2023-2799MEDIUMcnoa OA hard-coded passwordEPSS 0.8%CVE-2025-1100CRITICALA CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatedEPSS 0.8%CVE-2024-41616HIGHD-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.EPSS 0.8%CVE-2024-7170MEDIUMTOTOLINK A3000RU product.ini hard-coded passwordEPSS 0.7%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%CVE-2025-7079MEDIUMmao888 bluebell-plus JWT Token jwt.go hard-coded passwordEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%