Skip to content
OpenAdvisories

Weakness (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

Variant Draft

The product uses a hard-coded, unchangeable cryptographic key.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Prevention schemes mirror that of hard-coded password storage.

Source: MITRE CWE-321

All Critical High Medium Low Exploited only Public exploit

125 results · Clear filters · Feed

  • Medium 6.5
    CVE-2019-10990

    Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password t…

    Windows
  • Medium 6.8
    CVE-2019-7594

    Metasys use of hardcoded RC2 key

    Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).

    Johnson Controls Metasys versions prior to 9.0
  • Medium 4.6
    CVE-2018-10896

    The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init…

    Canonical cloud-init
  • Medium 6.8
    CVE-2014-5403

    Hospira MedNet Use of Hard-coded Cryptographic Key

    Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network.

    Hospira MedNet
  • Medium —
    CVE-2011-5064

    Use of Hard-coded Cryptographic Key in Apache Tomcat

    DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote a…

    org.apache.tomcat:tomcat Maven