Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-30406CRITICALGladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'EPSS 94.3%KEVCVE-2016-4437CRITICALApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitEPSS 93.0%KEVCVE-2023-32169CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 56.1%CVE-2020-10884HIGHThis vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190EPSS 38.8%CVE-2023-27584CRITICALDragonfly2 vulnerable to hard coded cyptographic keyEPSS 33.9%CVE-2021-4228MEDIUMHard-coded TLS CertificateEPSS 9.9%CVE-2019-10963—Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maEPSS 6.5%CVE-2020-6990CRITICALRockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsEPSS 5.9%CVE-2022-1701—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.EPSS 4.8%CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.5%CVE-2020-1764HIGHA hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote atEPSS 3.5%CVE-2026-74233CRITICALZbtlink MQWrt infosrvd Command InjectionEPSS 3.4%CVE-2026-26335CRITICALCalero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCEEPSS 3.0%CVE-2025-13316HIGHHard-coded encryption keys in Twonky ServerEPSS 2.8%CVE-2026-86708CRITICALSensitive data exposureEPSS 2.7%CVE-2026-89026CRITICALIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originateEPSS 2.7%CVE-2021-40119CRITICALCisco Policy Suite Static SSH Keys VulnerabilityEPSS 2.5%CVE-2014-5419—GE Multilink Use of Hard-coded Cryptographic KeyEPSS 2.4%CVE-2019-5137HIGHThe usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fEPSS 2.3%CVE-2025-57174CRITICALAn issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoEPSS 2.2%