Fallos del tipo CWE-321

360 resultados

Chave criptográfica embutida no código

A aplicação armazena uma chave criptográfica diretamente no código-fonte, configuração ou binário. Qualquer pessoa com acesso ao código (desenvolvedores, invasores, analistas de engenharia reversa) consegue extrair a chave e descriptografar dados que deveriam estar protegidos.

Ejemplo

Um app mobile que faz login via API usa uma chave AES gravada como `const SECRET_KEY = 'a1b2c3d4e5f6g7h8'` no código Java. Um invasor descompila o APK, encontra a chave em texto claro e passa a interceptar e descriptografar todas as requisições criptografadas do app.

Cómo mitigar

Gere chaves criptograficamente seguras e armazene-as em sistemas de gerenciamento de segredos (vaults como HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) ou em módulos de segurança de hardware (HSM). Nunca comita chaves em repositórios de código ou arquivos de configuração.

CVE-2026-31986CRITICALApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionEPSS 0.4%CVE-2026-5527MEDIUMTenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded keyEPSS 0.4%CVE-2019-19753CRITICALSimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes idEPSS 0.4%CVE-2023-42492HIGH EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2024-20350HIGHCisco Catalyst Center Static SSH Host Key VulnerabilityEPSS 0.4%CVE-2022-34442HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker wiEPSS 0.4%CVE-2026-78225CRITICALWärtsilä FOS-Onboard Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2025-34234CRITICALVasion Print (formerly PrinterLogic) Hardcoded Encryption Private KeysEPSS 0.4%CVE-2025-55619CRITICALReolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulEPSS 0.4%CVE-2025-67112CRITICALUse of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) EPSS 0.4%CVE-2025-11290MEDIUMCRMEB JWT HMAC Secret hard-coded keyEPSS 0.4%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2023-3947LOWVideo Conferencing with Zoom <= 4.2.1 - Sensitive Information ExposureEPSS 0.4%CVE-2026-5549MEDIUMTenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded keyEPSS 0.4%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.4%CVE-2026-9220HIGHSetracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic keyEPSS 0.4%CVE-2017-14014—Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removablEPSS 0.4%CVE-2025-34211CRITICALVasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private KeysEPSS 0.4%CVE-2025-6669MEDIUMgooaclok819 sublinkX jwt.go hard-coded keyEPSS 0.4%CVE-2025-12615LOWPHPGurukul News Portal settings.py hard-coded keyEPSS 0.4%