Fallos del tipo CWE-321

362 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2026-81821HIGHAVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic keyEPSS 0.1%CVE-2026-5456MEDIUMAlign Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded keyEPSS 0.1%CVE-2025-4876MEDIUMHardcoded Key Revealed in ConnectWise Password Encryption UtilityEPSS 0.1%CVE-2026-39810MEDIUMA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosEPSS 0.1%CVE-2026-5420LOWShinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded keyEPSS 0.1%CVE-2026-2103HIGHUse of Hard-Coded Cryptographic Key for Password StorageEPSS 0.1%CVE-2026-5310LOWEnter Software Iperius Backup IperiusAccounts.ini hard-coded keyEPSS 0.1%CVE-2026-0754HIGHSIP Service Providers – Possible Impersonation of Poly Voice DeviceEPSS 0.1%CVE-2026-44278LOWA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions EPSS 0.1%CVE-2025-52601MEDIUMHardcoding sensitive informationEPSS 0.1%CVE-2026-78487MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-80167MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-80057MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-39031MEDIUMLansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-charactEPSS 0.1%CVE-2026-32324HIGHAnviz CX7 Firmware Use of Hard-coded Cryptographic KeyEPSS 0.1%CVE-2026-11347HIGHHardcoded Cryptographic Keys and Weak IV Generation in linqiEPSS 0.1%CVE-2026-50603MEDIUMHard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSenseEPSS 0.1%CVE-2026-50606LOWHard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense SoftwareEPSS 0.1%CVE-2025-58740HIGHHardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector CaptureEPSS 0.1%CVE-2026-86708CRITICALSensitive data exposureEPSS —