Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.4%CVE-2024-7216LOWTOTOLINK LR1200 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-70041CRITICALAn issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.EPSS 0.4%CVE-2024-35395HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attaEPSS 0.4%CVE-2025-30115CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSEPSS 0.4%CVE-2024-32210MEDIUMThe LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL coEPSS 0.4%CVE-2024-27774HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded PasswordEPSS 0.4%CVE-2025-11284MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded passwordEPSS 0.4%CVE-2025-2342MEDIUMIROAD X5 Mobile App API Endpoint hard-coded credentialsEPSS 0.4%CVE-2026-35905CRITICALT3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access EPSS 0.4%CVE-2024-3699CRITICALHardcoded password in drEryk GabinetEPSS 0.4%CVE-2024-1228CRITICALHardcoded password in Eurosoft PrzychodniaEPSS 0.4%CVE-2025-14126HIGHTOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentialsEPSS 0.4%CVE-2025-6139LOWTOTOLINK T10 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-58081HIGHUse of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenEPSS 0.4%CVE-2023-29103MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versiEPSS 0.4%CVE-2025-7453MEDIUMsaltbo zpan JSON Web Token token.go NewToken hard-coded passwordEPSS 0.4%CVE-2025-25984MEDIUMAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%