Weaknesses of type CWE-321

317 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2023-3371MEDIUMEmbedPress <= 3.7.3 - Sensitive Information ExposureEPSS 0.5%CVE-2022-2641CRITICALHorner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform uEPSS 0.5%CVE-2025-62581CRITICALDIAView - Authentication Bypass VulnerabilityEPSS 0.5%CVE-2024-58134HIGHMojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by defaultEPSS 0.5%CVE-2025-59407CRITICALThe Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow LicensEPSS 0.5%CVE-2025-41702CRITICALegOS WebGUI Hard-Coded JWT Secret Enables Authentication BypassEPSS 0.5%CVE-2021-38461HIGHAUVESY VersiondogEPSS 0.5%CVE-2019-19752CRITICALnvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identificationEPSS 0.5%CVE-2025-65998HIGHApache Syncope: Default AES key used for internal password encryptionEPSS 0.5%CVE-2025-67305CRITICALIn RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical aEPSS 0.5%CVE-2019-17098LOWUse of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge AppEPSS 0.5%CVE-2025-30095CRITICALVyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear privateEPSS 0.5%CVE-2025-8759MEDIUMTRENDnet TN-200 Lighttpd hard-coded keyEPSS 0.5%CVE-2025-11609MEDIUMcode-projects Hospital Management System express-session hard-coded keyEPSS 0.5%CVE-2026-35019CRITICALNetComm NF20MESH < R6B032 Hardcoded AES Key Authentication BypassEPSS 0.5%CVE-2022-34440HIGHDell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker withEPSS 0.5%CVE-2022-34441HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker witEPSS 0.5%CVE-2024-41260HIGHA static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtaEPSS 0.5%CVE-2023-49256HIGHPredictable encryption passphrase used in publicly accessible configuration fileEPSS 0.5%CVE-2025-15105MEDIUMgetmaxun auth.ts hard-coded keyEPSS 0.5%