Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-34029MEDIUMHard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration dataEPSS 0.1%CVE-2026-102812MEDIUMHardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7EPSS 0.1%CVE-2026-34022HIGHWeak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryptionEPSS 0.1%CVE-2026-6787HIGHUsage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing processEPSS 0.1%CVE-2024-20280MEDIUMCisco UCS Central Software Configuration Backup Static Key VulnerabilityEPSS 0.1%CVE-2023-20016MEDIUMCisco FXOS Software and UCS Manager Software Configuration Backup Static Key VulnerabilityEPSS 0.1%CVE-2026-5455MEDIUMDialogue App ca.diagram.dialogue config.json hard-coded keyEPSS 0.1%CVE-2026-2103HIGHUse of Hard-Coded Cryptographic Key for Password StorageEPSS 0.1%CVE-2025-4876MEDIUMHardcoded Key Revealed in ConnectWise Password Encryption UtilityEPSS 0.1%CVE-2026-5456MEDIUMAlign Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded keyEPSS 0.1%CVE-2026-5420LOWShinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded keyEPSS 0.1%CVE-2026-5310LOWEnter Software Iperius Backup IperiusAccounts.ini hard-coded keyEPSS 0.1%CVE-2026-0754HIGHSIP Service Providers – Possible Impersonation of Poly Voice DeviceEPSS 0.1%CVE-2026-39810MEDIUMA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1 may aEPSS 0.1%CVE-2026-50603MEDIUMHard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSenseEPSS 0.1%CVE-2026-50606LOWHard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense SoftwareEPSS 0.1%CVE-2026-44278LOWA use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions EPSS 0.1%CVE-2026-34499HIGHUse of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issuEPSS 0.1%CVE-2026-71456HIGHUse of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affEPSS 0.1%CVE-2025-52601MEDIUMHardcoding sensitive informationEPSS 0.1%