Falhas do tipo CWE-321

360 resultados

Chave criptográfica embutida no código

Armazenar chaves criptográficas diretamente no código-fonte ou binário da aplicação expõe-as a qualquer pessoa com acesso ao repositório, arquivo compilado ou descompilado. Uma chave descoberta invalida toda a segurança que ela deveria proteger — tanto para cifração quanto para autenticação ou assinatura.

Exemplo

Uma API que usa a string `const API_KEY = '5f8e2b9c4d1a7x3q'` hardcoded no arquivo index.js. Qualquer dev que clone o repositório, ou um atacante que decompile o app mobile, obtém a chave e pode fazer requisições como se fosse a aplicação legítima.

Como mitigar

Armazene chaves em variáveis de ambiente, cofres de secrets (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração fora do versionamento (adicionados ao .gitignore). Nunca commite credenciais no git; use ferramentas como pre-commit hooks para detectar e bloquear antes do envio.

CVE-2026-81478HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthentEPSS 0.4%CVE-2017-5242HIGHRapid7 Nexpose Virtual Appliance Duplicate SSH Host KeyEPSS 0.4%CVE-2025-5353HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentialEPSS 0.4%CVE-2025-22455HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentialsEPSS 0.4%CVE-2024-35344CRITICALCertain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B85EPSS 0.4%CVE-2023-46129HIGHxkeys Seal encryption used fixed key for all encryptionEPSS 0.4%CVE-2025-38741HIGHDell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentiEPSS 0.4%CVE-2024-33849MEDIUMci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.EPSS 0.4%CVE-2024-42418HIGHAvtec Outpost Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2025-35052MEDIUMNewforma Info Exchange (NIX) shared hard-coded secret keyEPSS 0.4%CVE-2026-9770HIGHHardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71EPSS 0.4%CVE-2025-22463HIGHA hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environmenEPSS 0.4%CVE-2024-52881HIGHAn issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is EPSS 0.4%CVE-2026-3963MEDIUMperfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded keyEPSS 0.4%CVE-2026-16504CRITICALVPS.org one-click Zulip template deployment instance contains multiple vulnerabilitiesEPSS 0.4%CVE-2026-14932MEDIUMUnauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChartEPSS 0.4%CVE-2025-45746MEDIUMIn ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service coEPSS 0.4%CVE-2018-10896MEDIUMThe default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoEPSS 0.4%CVE-2025-14651MEDIUMMartialBE one-hub docker-compose.yml hard-coded keyEPSS 0.4%CVE-2025-15627MEDIUMHardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationEPSS 0.3%