Falhas do tipo CWE-798

943 resultados

Credenciais codificadas em tempo de compilação

É quando senhas, chaves de API, tokens ou outras credenciais são gravadas diretamente no código-fonte ou em arquivos de configuração sem proteção. O desenvolvedor deixa explícito no binário ou repositório dados que deveriam ser secretos, permitindo que qualquer pessoa com acesso ao código ou ao executável extraia as credenciais e acesse sistemas protegidos.

Exemplo

Um desenvolvedor coloca `const apiKey = 'sk-prod-abc123xyz'` no código JavaScript, ou deixa `<password>admin123</password>` em um arquivo XML dentro da aplicação. Um atacante ou concorrente com acesso ao repositório Git ou ao APK extraído consegue encontrar e usar essas credenciais em produção.

Como mitigar

Armazene credenciais em variáveis de ambiente, cofres de segurança (como AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) ou arquivos de configuração externos não versionados. Nunca commite credenciais no repositório; use ferramentas de escaneamento de repositórios para detectar padrões de senhas antes do push.

CVE-2026-37152CRITICALTOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.EPSS 0.5%CVE-2026-28776HIGHHardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite ReceiverEPSS 0.5%CVE-2023-39421HIGHUse of Hard-coded Credentials in RDPWin.dllEPSS 0.5%CVE-2024-32053CRITICALCyberPower PowerPanel business Use of Hard-coded CredentialsEPSS 0.5%CVE-2023-3264MEDIUMThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internalEPSS 0.5%CVE-2024-28990MEDIUMSolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.5%CVE-2025-56749CRITICALCreativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attaEPSS 0.5%CVE-2026-42375CRITICALD-Link DIR-600L A1 Hardcoded Telnet Backdoor CredentialsEPSS 0.5%CVE-2026-42374CRITICALD-Link DIR-600L B1 Hardcoded Telnet Backdoor CredentialsEPSS 0.5%CVE-2026-42373CRITICALD-Link DIR-605L B2 Hardcoded Telnet Backdoor CredentialsEPSS 0.5%CVE-2023-34473MEDIUMUsage of Hard-coded CredentialsEPSS 0.5%CVE-2025-45813CRITICALENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.EPSS 0.5%CVE-2025-30137CRITICALAn issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile applicatEPSS 0.5%CVE-2023-2504HIGH Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. EPSS 0.5%CVE-2026-42376CRITICALD-Link DIR-456U A1 Hardcoded Telnet Backdoor CredentialsEPSS 0.5%CVE-2024-46436HIGHHardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnEPSS 0.5%CVE-2017-20234CRITICALGarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded StringEPSS 0.5%CVE-2026-25202CRITICALThe database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue EPSS 0.5%CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.5%CVE-2026-9139CRITICALTaiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtmlEPSS 0.5%