Fallos del tipo CWE-259

210 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2024-39585HIGHDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. EPSS 0.3%CVE-2025-61330MEDIUMA hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. TEPSS 0.3%CVE-2026-11515MEDIUMSourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordEPSS 0.3%CVE-2026-6610MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2025-30106HIGHOn IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attackeEPSS 0.3%CVE-2026-2702LOWBeetel 777VR1 WPA2 PSK hard-coded credentialsEPSS 0.3%CVE-2022-26388MEDIUMUse of Hard-Coded Password Vulnerability in ELI Electrocardiograph DevicesEPSS 0.3%CVE-2021-27452—The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentiEPSS 0.3%CVE-2024-27164HIGHHardcoded credentialsEPSS 0.3%CVE-2024-7155LOWTOTOLINK A3300R shadow.sample hard-coded passwordEPSS 0.3%CVE-2025-54754HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded PasswordEPSS 0.2%CVE-2026-22054MEDIUMActive IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perEPSS 0.2%CVE-2026-22055MEDIUMActive IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to performEPSS 0.2%CVE-2025-1879LOWi-Drive i11/i12 APK hard-coded credentialsEPSS 0.2%CVE-2024-46328HIGHVONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root.EPSS 0.2%CVE-2025-7564HIGHLB-LINK BL-AC3600 shadow hard-coded credentialsEPSS 0.2%CVE-2023-0808LOWDeye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordEPSS 0.2%CVE-2024-46959MEDIUMrunofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1EPSS 0.2%CVE-2025-9091LOWTenda AC20 shadow hard-coded credentialsEPSS 0.2%CVE-2025-47823LOWFlock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.EPSS 0.2%