Weaknesses of type CWE-321

324 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2025-26340HIGHA CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenEPSS 1.1%CVE-2022-20773HIGHCisco Umbrella Virtual Appliance Static SSH Host Key VulnerabilityEPSS 1.1%CVE-2024-5296CRITICALD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityEPSS 1.1%CVE-2020-28391—A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sEPSS 1.1%CVE-2023-21705HIGHMicrosoft SQL Server Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5722HIGHLogsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-34215CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCEEPSS 1.1%CVE-2024-33891HIGHDelinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebServiceEPSS 1.0%CVE-2022-29828MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.0%CVE-2022-29829MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOEPSS 1.0%CVE-2022-29827MEDIUMUse of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthentiEPSS 1.0%CVE-2021-27389—A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key iEPSS 1.0%CVE-2021-32520CRITICALQSAN Storage Manager - Use of Hard-coded Cryptographic KeyEPSS 1.0%CVE-2020-7846HIGHHelpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads toEPSS 1.0%CVE-2026-5426CRITICALKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueEPSS 1.0%CVE-2023-37936CRITICALA use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 througEPSS 1.0%CVE-2022-21199HIGHAn information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted manEPSS 0.9%CVE-2023-27583CRITICALPanindex uses hard coded cyptographic keyEPSS 0.9%CVE-2024-1631CRITICALagent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`EPSS 0.9%CVE-2021-0266HIGHcSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.EPSS 0.9%