Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2022-41653CRITICALDaikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials andEPSS 0.7%CVE-2023-41030MEDIUMJuplink RX4-1500 Hard-coded Credential VulnerabilityEPSS 0.7%CVE-2024-43423CRITICALDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded PasswordEPSS 0.7%CVE-2025-8231HIGHD-Link DIR-890L UART Port rgbin hard-coded credentialsEPSS 0.7%CVE-2024-11630MEDIUME-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentialsEPSS 0.6%CVE-2024-11026MEDIUMIntelligent Apps Freenow App Keystore SSL.java hard-coded passwordEPSS 0.6%CVE-2024-27488CRITICALIncorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain senEPSS 0.6%CVE-2024-32741CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is usedEPSS 0.6%CVE-2025-11126CRITICALApeman ID71 system.ini hard-coded credentialsEPSS 0.6%CVE-2024-31810CRITICALTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.EPSS 0.6%CVE-2023-41713—SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.EPSS 0.6%CVE-2025-15111CRITICALKsenia Security lares Home Automation 1.6 Default Credentials VulnerabilityEPSS 0.6%CVE-2024-28010CRITICALUse of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, WEPSS 0.6%CVE-2025-9310MEDIUMyeqifu carRental Druid login.html hard-coded credentialsEPSS 0.6%CVE-2024-34025CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.6%CVE-2024-42639CRITICALH3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2024-7159MEDIUMTOTOLINK A3600R Telnet Service product.ini hard-coded passwordEPSS 0.6%CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2023-2061MEDIUMAuthentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesEPSS 0.5%CVE-2024-34211HIGHTOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attacEPSS 0.5%