Fallos del tipo CWE-321

360 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2024-1631CRITICALagent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`EPSS 0.9%CVE-2021-0266HIGHcSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.EPSS 0.9%CVE-2020-25193MEDIUMGE Reason RT43X Clocks Use of Hard-coded Cryptographic KeyEPSS 0.9%CVE-2024-30207CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.8%CVE-2022-34425HIGHDell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentialEPSS 0.8%CVE-2023-34123—Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versiEPSS 0.8%CVE-2021-22644HIGHOvarro TBox Use of Hard-coded Cryptographic KeyEPSS 0.8%CVE-2026-35019CRITICALNetComm NF20MESH < R6B032 Hardcoded AES Key Authentication BypassEPSS 0.8%CVE-2026-25894CRITICALFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationEPSS 0.8%CVE-2022-1400HIGHHardcoded encryption key IV in Exago WebReportsApi.dllEPSS 0.8%CVE-2026-75431CRITICALPowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote aEPSS 0.8%CVE-2023-3632CRITICALHard-coded Cryptographic Key in Kunduz - Homework Helper AppEPSS 0.8%CVE-2023-39465HIGHTriangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-22844HIGHAn authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-craftEPSS 0.8%CVE-2026-25505CRITICALBambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require AuthenticationEPSS 0.8%CVE-2024-1920MEDIUMosuuu LightPicture TokenVerify.php handle hard-coded keyEPSS 0.7%CVE-2025-34217CRITICALVasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH KeyEPSS 0.7%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2022-20868MEDIUMA vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco SecureEPSS 0.7%CVE-2025-5164MEDIUMPerfreeBlog JWT JwtUtil hard-coded keyEPSS 0.7%