Weakness (CWE)
CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
How to prevent it (1 mitigation)
-
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
Source: MITRE CWE-321
143 results · Clear filters · Feed
-
High 8.1
MGT-COMMERCE CloudPanel Shared Certificate
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor th…
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
-
High 8.8
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local …
-
High 8.0
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 8.4
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, w…
-
High 7.7
Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key
Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
-
High 8.0
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 8.4
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 7.5
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote att…
-
High 7.1
Hardcoded encryption key IV in Exago WebReportsApi.dll
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prio…
-
High 7.5
Ovarro TBox Use of Hard-coded Cryptographic Key
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
-
High 7.5
Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could e…
-
High 7.4
Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service back…
-
High 7.2
Use of Hard-coded Cryptographic Key in Netmaker
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if t…
-
High 8.8
Use of Hard-coded Cryptographic Key in gravitl/netmaker
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
-
High 7.5
An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A …
-
High 8.2
Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A loca…
-
High 8.2
AUVESY Versiondog
The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries.
-
High 8.1
cSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.
The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a cSRX deployment through device management services. This issue affects: Juniper Networks Junos OS on…
-
High 8.0
Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key…
-
High 8.6CVE-2020-1764 Public exploit
Hard coded cryptographic key in Kiali
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…
-
High 8.1
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer…
-
High 7.5
The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic…