Falhas do tipo CWE-321

423 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-12615LOWPHPGurukul News Portal settings.py hard-coded keyEPSS 0.4%CVE-2025-67112CRITICALUse of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) EPSS 0.4%CVE-2026-15469HIGHHard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800EPSS 0.4%CVE-2026-5549MEDIUMTenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded keyEPSS 0.4%CVE-2025-34234CRITICALVasion Print (formerly PrinterLogic) Hardcoded Encryption Private KeysEPSS 0.4%CVE-2025-38741HIGHDell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentiEPSS 0.4%CVE-2026-51977CRITICALAn issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilegeEPSS 0.4%CVE-2026-14804CRITICALHardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.4%CVE-2026-111636CRITICALOpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session SecretEPSS 0.4%CVE-2025-11290MEDIUMCRMEB JWT HMAC Secret hard-coded keyEPSS 0.4%CVE-2023-3947LOWVideo Conferencing with Zoom <= 4.2.1 - Sensitive Information ExposureEPSS 0.4%CVE-2026-9220HIGHSetracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic keyEPSS 0.4%CVE-2025-34211CRITICALVasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private KeysEPSS 0.4%CVE-2017-5242HIGHRapid7 Nexpose Virtual Appliance Duplicate SSH Host KeyEPSS 0.4%CVE-2017-14014—Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removablEPSS 0.4%CVE-2026-18181HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.4%CVE-2026-47097HIGHAJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export BundleEPSS 0.4%CVE-2026-113466MEDIUMMinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded keyEPSS 0.4%CVE-2025-22455HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentialsEPSS 0.4%CVE-2025-5353HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentialEPSS 0.4%