Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2024-13842MEDIUMA hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticatEPSS 0.3%CVE-2020-25234—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). TEPSS 0.3%CVE-2026-79735MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2026-9770HIGHHardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71EPSS 0.3%CVE-2024-38314MEDIUMIBM Maximo Application Suite - Monitor Component information disclosureEPSS 0.3%CVE-2026-78486MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.3%CVE-2026-13184HIGHRadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.3%CVE-2024-54855MEDIUMfabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly exeEPSS 0.3%CVE-2026-111696HIGHdata-platform-open through commit efeacd3 Hardcoded AES Key for Datasource PasswordsEPSS 0.3%CVE-2026-33266HIGHApache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltEPSS 0.3%CVE-2026-111460HIGHStatic HTTPS private key and CA private key in firmware in OnCell G3150A-LTE SeriesEPSS 0.3%CVE-2024-33504LOWA use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7EPSS 0.3%CVE-2026-79551HIGHTenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.EPSS 0.3%CVE-2026-49008MEDIUMIntegrity‑check credential leakage vulnerability in an application function of ZTE F689 productEPSS 0.3%CVE-2020-25173—Reolink P2P CamerasEPSS 0.3%CVE-2025-6074MEDIUMAuthentication Bypass to the MQTT configuration Web InterfaceEPSS 0.3%CVE-2015-10148HIGHHirschmann HiLCOS Hard-coded Credentials SSH SSL KeysEPSS 0.3%CVE-2023-40464HIGHUse of hardcoded certificate and private keyEPSS 0.3%CVE-2026-71449CRITICAL: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue aEPSS 0.3%CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%