Fallos del tipo CWE-321

360 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2025-54807CRITICALDover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2024-6890CRITICALJournyx Unauthenticated Password Reset BruteforceEPSS 0.7%CVE-2023-3404MEDIUMProfileGrid <= 5.5.0 - Hardcoded Encryption KeyEPSS 0.7%CVE-2025-27674CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.EPSS 0.7%CVE-2025-34256CRITICALAdvantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication BypassEPSS 0.7%CVE-2023-44318MEDIUMAffected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could alloEPSS 0.7%CVE-2024-30407CRITICAL[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacksEPSS 0.7%CVE-2025-11899CRITICALFlowring Technology｜Agentflow - Use of Hard-coded Cryptographic KeyEPSS 0.7%CVE-2025-59407CRITICALThe Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow LicensEPSS 0.7%CVE-2022-26020MEDIUMAn information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A speEPSS 0.7%CVE-2026-56271CRITICALFlowise - Weak Default JWT Secrets in Authentication MiddlewareEPSS 0.7%CVE-2018-3825—In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper accesEPSS 0.7%CVE-2020-25229—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communicatioEPSS 0.6%CVE-2025-44963CRITICALRUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain sEPSS 0.6%CVE-2026-47410CRITICALpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unsetEPSS 0.6%CVE-2019-7594MEDIUMMetasys use of hardcoded RC2 keyEPSS 0.6%CVE-2024-46612CRITICALIceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.EPSS 0.6%CVE-2023-2158CRITICALImpersonation through User-Controlled TokenEPSS 0.6%CVE-2025-15107MEDIUMactiontech sqle JWT Secret jwt.go hard-coded keyEPSS 0.6%CVE-2022-2660CRITICALDelta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowEPSS 0.6%