Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2023-23770CRITICALMotorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing EPSS 0.5%CVE-2024-38902CRITICALH3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.5%CVE-2024-25825CRITICALFydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the EPSS 0.5%CVE-2024-39345HIGHAdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support EPSS 0.5%CVE-2025-8974MEDIUMlinlinjava litemall JSON Web Token JwtHelper.java hard-coded credentialsEPSS 0.5%CVE-2024-38885HIGHAn issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker tEPSS 0.5%CVE-2024-33625CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.5%CVE-2024-34539CRITICALHardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. TEPSS 0.5%CVE-2023-37231CRITICALLoftware Spectrum before 4.6 HF14 uses a Hard-coded Password.EPSS 0.5%CVE-2024-2420HIGHLenelS2 NetBox Hardcoded CredentialsEPSS 0.5%CVE-2026-7251CRITICALEppendorf BioFlo 320 Use of hard-coded passwordEPSS 0.5%CVE-2023-50948MEDIUMIBM Storage Fusion HCI information disclosureEPSS 0.5%CVE-2024-2038HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded CredentialsEPSS 0.5%CVE-2021-27254MEDIUMThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is EPSS 0.5%CVE-2020-12037—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TEPSS 0.5%CVE-2025-59388MEDIUMHyper Data ProtectorEPSS 0.5%CVE-2026-19750CRITICALTenda CH/CP/TX3 SSH hard-coded passwordEPSS 0.5%CVE-2024-37644HIGHTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackerEPSS 0.5%CVE-2022-29825MEDIUMUse of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) veEPSS 0.5%CVE-2025-44955HIGHRUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.EPSS 0.5%