Falhas do tipo CWE-321

427 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2022-34425HIGHDell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentialEPSS 0.9%CVE-2025-30206CRITICALDpanel's hard-coded JWT secret leads to remote code executionEPSS 0.9%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%CVE-2024-1631CRITICALagent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`EPSS 0.9%CVE-2021-0266HIGHcSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.EPSS 0.9%CVE-2020-25193MEDIUMGE Reason RT43X Clocks Use of Hard-coded Cryptographic KeyEPSS 0.9%CVE-2026-25894CRITICALFUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default ConfigurationEPSS 0.8%CVE-2024-30207CRITICALA vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageEPSS 0.8%CVE-2021-22644HIGHOvarro TBox Use of Hard-coded Cryptographic KeyEPSS 0.8%CVE-2022-1400HIGHHardcoded encryption key IV in Exago WebReportsApi.dllEPSS 0.8%CVE-2023-34123—Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versiEPSS 0.8%CVE-2026-25505CRITICALBambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require AuthenticationEPSS 0.8%CVE-2026-35019CRITICALNetComm NF20MESH < R6B032 Hardcoded AES Key Authentication BypassEPSS 0.8%CVE-2022-20868MEDIUMA vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco SecureEPSS 0.8%CVE-2025-5164MEDIUMPerfreeBlog JWT JwtUtil hard-coded keyEPSS 0.8%CVE-2026-90945CRITICALCrawlab through 0.6.3 Authentication Bypass via Hard-coded JWT SecretEPSS 0.8%CVE-2023-3632CRITICALHard-coded Cryptographic Key in Kunduz - Homework Helper AppEPSS 0.8%CVE-2023-39465HIGHTriangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure VulnerabilityEPSS 0.8%CVE-2023-22844HIGHAn authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-craftEPSS 0.8%