Fallos del tipo CWE-321

427 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2025-30406CRITICALGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'EPSS 94.3%KEVCVE-2016-4437CRITICALApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitEPSS 93.0%KEVCVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2020-10884HIGHThis vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190EPSS 38.8%CVE-2023-27584CRITICALDragonfly2 vulnerable to hard coded cyptographic keyEPSS 33.9%CVE-2021-4228MEDIUMHard-coded TLS CertificateEPSS 9.9%CVE-2019-10963—Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maEPSS 6.5%CVE-2020-6990CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 5.9%CVE-2022-1701—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.EPSS 4.8%CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.5%CVE-2020-1764HIGHA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atEPSS 3.5%CVE-2026-74233CRITICALZbtlink MQWrt infosrvd Command InjectionEPSS 3.4%CVE-2026-26335CRITICALCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEEPSS 3.0%CVE-2025-13316HIGHHard-coded encryption keys in Twonky ServerEPSS 2.8%CVE-2026-86708CRITICALSensitive data exposureEPSS 2.7%CVE-2026-89026CRITICALIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originateEPSS 2.7%CVE-2021-40119CRITICALCisco Policy Suite Static SSH Keys VulnerabilityEPSS 2.5%CVE-2014-5419—GE Multilink Use of Hard-coded Cryptographic KeyEPSS 2.4%CVE-2019-5137HIGHThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fEPSS 2.3%CVE-2025-57174CRITICALAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoEPSS 2.2%