Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2025-26340HIGHA CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenEPSS 1.2%CVE-2020-25180MEDIUMRockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic KeyEPSS 1.2%CVE-2025-34215CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCEEPSS 1.1%CVE-2019-19750CRITICALminerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.EPSS 1.1%CVE-2024-5296CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 1.1%CVE-2020-28391—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2023-21705HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5722HIGHLogsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution VulnerabilityEPSS 1.1%CVE-2020-7846HIGHHelpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads toEPSS 1.1%CVE-2022-29829MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOEPSS 1.1%CVE-2022-29827MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2022-29828MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.1%CVE-2024-33891HIGHDelinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebServiceEPSS 1.0%CVE-2021-27389—A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key iEPSS 1.0%CVE-2021-32520CRITICALQSAN Storage Manager - Use of Hard-coded Cryptographic KeyEPSS 1.0%CVE-2026-5426CRITICALKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueEPSS 1.0%CVE-2023-37936CRITICALA use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 througEPSS 1.0%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2025-30206CRITICALDpanel's hard-coded JWT secret leads to remote code executionEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%