Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-75553LOWSmartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a EPSS 0.1%CVE-2025-56801MEDIUMThe Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementEPSS 0.1%CVE-2025-30200LOWECOVACS Vacuum and Base Station Hard-Coded AES EncryptionEPSS 0.1%CVE-2025-15605HIGHHardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600EPSS 0.1%CVE-2026-81326MEDIUMQND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clieEPSS 0.1%CVE-2026-103778MEDIUMDell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated aEPSS 0.1%CVE-2025-64304MEDIUM"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptographic keys.EPSS 0.1%CVE-2025-2810MEDIUMDraeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic KeyEPSS 0.1%CVE-2026-80057MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2025-26476HIGHDell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticEPSS 0.1%CVE-2026-78487MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2026-80167MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedEPSS 0.1%CVE-2025-56802MEDIUMThe Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers EPSS 0.1%CVE-2023-6482MEDIUMEncryption key derived from static host informationEPSS 0.1%CVE-2026-91912HIGHDell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attackeEPSS 0.1%CVE-2026-107171MEDIUMAn Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.EPSS 0.1%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%CVE-2026-25107MEDIUMELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knEPSS 0.1%CVE-2022-36925MEDIUMInsecure key generation for Zoom Rooms for macOS ClientsEPSS 0.1%CVE-2026-34029MEDIUMHard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration dataEPSS 0.1%