Weaknesses of type CWE-321

317 results

Chave criptográfica hardcoded

É quando a chave ou senha usada para criptografia fica embutida no código-fonte ou binário da aplicação. Qualquer pessoa com acesso ao código (incluindo atacantes que fazem engenharia reversa) consegue extrair a chave e descriptografar todos os dados protegidos por ela, anulando completamente a proteção criptográfica.

Example

Um app mobile que faz login criptografa a senha com uma chave fixa como `const ENCRYPTION_KEY = '12345abc'` no código. Um atacante faz dump do APK, encontra a chave em minutos, e consegue descriptografar todas as senhas armazenadas de todos os usuários.

How to mitigate

Armazene chaves em repositórios seguros (key management systems, vaults como AWS Secrets Manager ou HashiCorp Vault), derive chaves de senhas do usuário com algoritmos fortes (PBKDF2, Argon2), ou use mecanismos de derivação dinâmica. Nunca coloque chaves no código, comentários ou arquivos de configuração versionados.

CVE-2017-9649—A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, EPSS 0.5%CVE-2025-15016CRITICALRagic｜Enterprise Cloud Database - Hard-coded Cryptographic KeyEPSS 0.5%CVE-2025-54947MEDIUMApache StreamPark: Use hard-coded key vulnerabilityEPSS 0.5%CVE-2023-37291HIGHGalaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic KeyEPSS 0.5%CVE-2022-48625HIGHYealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary.EPSS 0.4%CVE-2024-10920LOWmariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded keyEPSS 0.4%CVE-2026-5527MEDIUMTenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded keyEPSS 0.4%CVE-2019-19753CRITICALSimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes idEPSS 0.4%CVE-2025-3177LOWFastCMS JWT hard-coded keyEPSS 0.4%CVE-2023-42492HIGH EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyEPSS 0.4%CVE-2026-31986CRITICALApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionEPSS 0.4%CVE-2022-34442HIGH Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.  An attacker wiEPSS 0.4%CVE-2025-55619CRITICALReolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulEPSS 0.4%CVE-2025-15005MEDIUMCouchCMS reCAPTCHA config.example.php hard-coded keyEPSS 0.4%CVE-2025-67112CRITICALUse of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) EPSS 0.4%CVE-2023-3947LOWVideo Conferencing with Zoom <= 4.2.1 - Sensitive Information ExposureEPSS 0.4%CVE-2017-14014—Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removablEPSS 0.4%CVE-2025-12599CRITICALMultiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)EPSS 0.4%CVE-2024-20350HIGHCisco Catalyst Center Static SSH Host Key VulnerabilityEPSS 0.4%CVE-2026-5549MEDIUMTenda AC10 RSA 2048-bit Private Key privkeySrv.pem hard-coded keyEPSS 0.4%