Falhas do tipo CWE-259

221 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2022-30271CRITICALThe Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_servEPSS 1.1%CVE-2022-22144HIGHA hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0EPSS 1.0%CVE-2023-46685CRITICALA hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specEPSS 1.0%CVE-2024-4708CRITICALmySCADA myPRO Use of Hard-coded PasswordEPSS 1.0%CVE-2014-125030MEDIUMtaoeffect Empress hard-coded passwordEPSS 1.0%CVE-2022-45444CRITICALCVE-2022-45444EPSS 0.9%CVE-2023-3237MEDIUMOTCMS hard-coded passwordEPSS 0.9%CVE-2026-113736CRITICALD-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty passwordEPSS 0.9%CVE-2023-32145HIGHD-Link DAP-1360 Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2018-25069HIGHNetis Netcore Router hard-coded passwordEPSS 0.9%CVE-2025-27638CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.EPSS 0.9%CVE-2024-29011HIGHUse of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlieEPSS 0.9%CVE-2024-36526CRITICALZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.EPSS 0.9%CVE-2025-7079MEDIUMmao888 bluebell-plus JWT Token jwt.go hard-coded passwordEPSS 0.8%CVE-2023-2799MEDIUMcnoa OA hard-coded passwordEPSS 0.8%CVE-2025-1100CRITICALA CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatedEPSS 0.8%CVE-2026-19750CRITICALTenda CH/CP/TX3 SSH hard-coded passwordEPSS 0.8%CVE-2025-8231HIGHD-Link DIR-890L UART Port rgbin hard-coded credentialsEPSS 0.8%CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.8%CVE-2024-41616HIGHD-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.EPSS 0.8%