Fallos del tipo CWE-321

361 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2026-45433HIGHHardcoded Cryptographic Key Vulnerability in GX Earth ONT ModelsEPSS 0.3%CVE-2026-54218HIGHTeamDavid: Weak Cryptography and Insecure Password StorageEPSS 0.3%CVE-2023-41137HIGHSymmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client andEPSS 0.3%CVE-2026-7018MEDIUMDatavane Datavines JWT Token TokenManager.java hard-coded keyEPSS 0.3%CVE-2026-22906CRITICALHardcoded Key Allows Credential DisclosureEPSS 0.3%CVE-2024-45837MEDIUMUse of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthentEPSS 0.3%CVE-2026-28742CRITICALNaxclow IoT Platform Use of hard-coded cryptographic keyEPSS 0.3%CVE-2026-52727HIGHlxc-ci: Pacman keyring stored in archlinux image with a private keyEPSS 0.3%CVE-2024-12078MEDIUMECOVACS lawnmowers and vacuums static BLE GATT encryption keyEPSS 0.3%CVE-2026-7306MEDIUMXuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard-coded keyEPSS 0.3%CVE-2026-54833HIGHWordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerabilityEPSS 0.3%CVE-2025-15108MEDIUMPandaXGO PandaX JWT Secret config.yml hard-coded keyEPSS 0.3%CVE-2025-46582HIGHPrivate Key Disclosure Vulnerability in ZTE ZXMP M721 ProductEPSS 0.3%CVE-2024-13842MEDIUMA hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticatEPSS 0.3%CVE-2020-25234—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). TEPSS 0.3%CVE-2026-78481MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2025-52373MEDIUMUse of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in databaseEPSS 0.3%CVE-2026-18753CRITICALHardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)EPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2026-18754CRITICALHardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)EPSS 0.3%