Weakness (CWE)
CWE-321: Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
How to prevent it (1 mitigation)
-
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
Source: MITRE CWE-321
435 results · Feed
-
High 8.8
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local …
-
High 8.0
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 8.4
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, w…
-
High 7.7
Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key
Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
-
High 8.0
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
High 8.4
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerabil…
-
Medium 4.4
Insecure key generation for Zoom Rooms for macOS Clients
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local l…
-
Critical 9.8
Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic …
-
Critical 9.8
Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an …
-
Critical 9.1
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and …
-
Medium 6.8
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT D…
-
Medium 6.8
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allow…
-
Medium 6.8
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allow…
-
Medium 4.7
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Man…
-
Medium 5.8CVE-2021-4228 EPSS 10%
Hard-coded TLS Certificate
Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.
-
High 7.5
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote att…
-
High 7.1
Hardcoded encryption key IV in Exago WebReportsApi.dll
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prio…
-
High 7.5
Ovarro TBox Use of Hard-coded Cryptographic Key
Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.
-
Critical 9.1
Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorize…
-
Unscored —
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key…
-
Medium 6.3
An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRo…
-
High 7.5
Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could e…
-
High 7.4
Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service back…
-
Medium 5.3
GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key
By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers would be able to intercept and decrypt encrypted traffic through an HTTPS connection.
-
Medium 5.3
Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key valu…
-
High 7.2
Use of Hard-coded Cryptographic Key in Netmaker
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if t…
-
High 8.8
Use of Hard-coded Cryptographic Key in gravitl/netmaker
Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
-
Critical 9.8
Advantech ADAM-3600
The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
-
High 7.5
An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A …
-
Medium 5.7
Use of Hard-coded Cryptographic Key
Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the firmware to decrypt network traffic between the AMC2 and the host system. Thus, an attacker can exp…
-
Medium 6.1
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC iX) Versions B.02, C.02, and C.03.
-
High 8.2
Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A loca…
-
Critical 9.8
Cisco Policy Suite Static SSH Keys Vulnerability
A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This vulnerability is due to the re-use of static SSH keys across installatio…
-
High 8.2
AUVESY Versiondog
The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries.
-
Critical 9.8
QSAN Storage Manager - Use of Hard-coded Cryptographic Key
Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
-
Unscored —
ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange proc…
-
Unscored —
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30).…
-
Unscored —
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network …
-
High 8.1
cSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services.
The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a cSRX deployment through device management services. This issue affects: Juniper Networks Junos OS on…
-
High 8.0
Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key…