Falhas do tipo CWE-321

362 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-42518HIGHInformation Disclosure Vulnerability in e-Sushrut HMISEPSS 0.2%CVE-2026-4477LOWYi Technology YI Home Camera WPA/WPS hard-coded keyEPSS 0.2%CVE-2026-32644CRITICALMilesight Cameras Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2025-30198LOWECOVACS Vacuum and Base Station Hard-Coded WPA2-PSKEPSS 0.2%CVE-2025-55112HIGHBMC Control-M/Agent hardcoded Blowfish keysEPSS 0.2%CVE-2021-43552MEDIUMPhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2026-18411HIGHUse of hard-coded cryptographic key in Acrisure KARR BT and DR-100EPSS 0.2%CVE-2026-13184HIGHRadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2025-48417MEDIUMHard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stationsEPSS 0.2%CVE-2025-52374MEDIUMUse of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other serverEPSS 0.2%CVE-2023-2637HIGHRockwell Automation FactoryTalk System Services Vulnerable To Use Of Hard-Coded Cryptographic KeyEPSS 0.2%CVE-2024-31410HIGHCyberPower PowerPanel business Use of Hard-coded Cryptographic KeyEPSS 0.2%CVE-2020-25233—A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices conEPSS 0.2%CVE-2026-79735MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.2%CVE-2022-34462HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge ofEPSS 0.2%CVE-2026-11505LOWGL.iNet XE3000 glnassys hard-coded keyEPSS 0.2%CVE-2026-53939CRITICALOpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryptionEPSS 0.2%CVE-2024-20323HIGHA vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection betwEPSS 0.2%CVE-2026-78486MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.2%CVE-2025-60250MEDIUMUnitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 284EPSS 0.2%