Falhas do tipo CWE-321

317 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-30406CRITICALGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'EPSS 93.8%KEVCVE-2016-4437CRITICALApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitEPSS 93.0%KEVCVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2023-27584CRITICALDragonfly2 vulnerable to hard coded cyptographic keyEPSS 33.6%CVE-2020-10884HIGHThis vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190EPSS 24.7%CVE-2021-4228MEDIUMHard-coded TLS CertificateEPSS 9.9%CVE-2026-62241CRITICALclawvet < 0.7.5 Hard-coded JWT Secret Session ForgeryEPSS 6.5%CVE-2019-10963—Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maEPSS 6.5%CVE-2022-1701—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.EPSS 4.6%CVE-2020-6990CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 4.4%CVE-2020-1764HIGHA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atEPSS 3.5%CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.1%CVE-2026-26335CRITICALCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEEPSS 2.8%CVE-2025-13316HIGHHard-coded encryption keys in Twonky ServerEPSS 2.7%CVE-2014-5419—GE Multilink Use of Hard-coded Cryptographic KeyEPSS 2.4%CVE-2021-40119CRITICALCisco Policy Suite Static SSH Keys VulnerabilityEPSS 2.4%CVE-2019-5137HIGHThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fEPSS 2.3%CVE-2017-6054—A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-cEPSS 2.1%CVE-2025-57174CRITICALAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoEPSS 2.1%CVE-2017-14021—A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-EPSS 1.9%