Fallos del tipo CWE-321

317 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2025-30406CRITICALGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'EPSS 93.8%KEVCVE-2016-4437CRITICALApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitEPSS 93.0%KEVCVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-27584CRITICALDragonfly2 vulnerable to hard coded cyptographic keyEPSS 33.6%CVE-2020-10884HIGHThis vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190EPSS 24.7%CVE-2021-4228MEDIUMHard-coded TLS CertificateEPSS 9.9%CVE-2026-62241CRITICALclawvet < 0.7.5 Hard-coded JWT Secret Session ForgeryEPSS 6.5%CVE-2019-10963—Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maEPSS 6.5%CVE-2022-1701—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.EPSS 4.6%CVE-2020-6990CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 4.4%CVE-2020-1764HIGHA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atEPSS 3.5%CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.1%CVE-2026-26335CRITICALCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEEPSS 2.8%CVE-2025-13316HIGHHard-coded encryption keys in Twonky ServerEPSS 2.7%CVE-2014-5419—GE Multilink Use of Hard-coded Cryptographic KeyEPSS 2.4%CVE-2021-40119CRITICALCisco Policy Suite Static SSH Keys VulnerabilityEPSS 2.4%CVE-2019-5137HIGHThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fEPSS 2.3%CVE-2017-6054—A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-cEPSS 2.1%CVE-2025-57174CRITICALAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoEPSS 2.1%CVE-2017-14021—A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-EPSS 1.9%