Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2022-2660CRITICALDelta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allowEPSS 0.6%CVE-2024-1258LOWJuanpao JPShop API params.php hard-coded keyEPSS 0.6%CVE-2025-8625CRITICALCopypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code ExecutionEPSS 0.6%CVE-2023-0391HIGHMGT-COMMERCE CloudPanel Shared CertificateEPSS 0.6%CVE-2026-24218HIGHNVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keyEPSS 0.6%CVE-2025-62581CRITICALDIAView - Authentication Bypass VulnerabilityEPSS 0.6%CVE-2024-2413CRITICALIntumit SmartRobot - Use of Hard-coded Cryptographic KeyEPSS 0.6%CVE-2023-48392CRITICALKaifa Technology WebITR - Hard-coded Cryptographic KeyEPSS 0.6%CVE-2022-2641CRITICALHorner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform uEPSS 0.6%CVE-2021-38461HIGHAUVESY VersiondogEPSS 0.5%CVE-2026-28326HIGHSolarWinds Access Rights Manager Unauthenticated Remote Code Execution VulnerabilityEPSS 0.5%CVE-2023-3371MEDIUMEmbedPress <= 3.7.3 - Sensitive Information ExposureEPSS 0.5%CVE-2025-15105MEDIUMgetmaxun auth.ts hard-coded keyEPSS 0.5%CVE-2025-15016CRITICALRagic｜Enterprise Cloud Database - Hard-coded Cryptographic KeyEPSS 0.5%CVE-2026-90945CRITICALCrawlab through 0.6.3 Authentication Bypass via Hard-coded JWT SecretEPSS 0.5%CVE-2024-58134HIGHMojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by defaultEPSS 0.5%CVE-2025-41702CRITICALegOS WebGUI Hard-Coded JWT Secret Enables Authentication BypassEPSS 0.5%CVE-2026-89026CRITICALIssabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originateEPSS 0.5%CVE-2025-11609MEDIUMcode-projects Hospital Management System express-session hard-coded keyEPSS 0.5%CVE-2025-67305CRITICALIn RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical aEPSS 0.5%