Fallos del tipo CWE-321

360 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2025-26340HIGHA CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenEPSS 1.2%CVE-2020-25180MEDIUMRockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic KeyEPSS 1.2%CVE-2025-34215CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCEEPSS 1.1%CVE-2019-19750CRITICALminerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.EPSS 1.1%CVE-2024-5296CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 1.1%CVE-2020-28391—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2023-21705HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5722HIGHLogsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution VulnerabilityEPSS 1.1%CVE-2020-7846HIGHHelpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads toEPSS 1.1%CVE-2022-29829MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOEPSS 1.1%CVE-2022-29827MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2022-29828MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2024-33891HIGHDelinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebServiceEPSS 1.0%CVE-2021-27389—A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key iEPSS 1.0%CVE-2021-32520CRITICALQSAN Storage Manager - Use of Hard-coded Cryptographic KeyEPSS 1.0%CVE-2026-5426CRITICALKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueEPSS 1.0%CVE-2023-37936CRITICALA use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 througEPSS 1.0%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2025-30206CRITICALDpanel's hard-coded JWT secret leads to remote code executionEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%