Skip to content
OpenAdvisories

Weakness (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

Variant Draft

The product uses a hard-coded, unchangeable cryptographic key.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Prevention schemes mirror that of hard-coded password storage.

Source: MITRE CWE-321

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2026-28326 Public exploit

    SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

    SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

    SolarWinds Access Rights Manager
  • High 7.5
    CVE-2026-79551 Public exploit

    Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

  • High 7.7
    CVE-2026-15469 Public exploit

    Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800

    The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6.  A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol fo…

    TP-Link Systems Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 Network devices
  • High 7.3
    CVE-2025-55449 Public exploit

    AstrBot is vulnerable to RCE with hard-coded JWT signing keys

    AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

    astrbot PyPI
  • High 8.2
    CVE-2025-13316 Public exploit

    Hard-coded encryption keys in Twonky Server

    Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and…

    Lynxtechnology Twonky Server
  • High 7.7
    CVE-2024-56429 Public exploit

    itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users …

    Itech iLabClient
  • High 8.6
    CVE-2020-1764 Public exploit

    Hard coded cryptographic key in Kiali

    A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…

    Red Hat kiali github.com/kiali/kiali Go
  • High 8.1
    CVE-2020-10884 Public exploit EPSS 39%

    This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer…

    TP-Link Archer A7 Network devices