Use of Hard-coded Cryptographic Key
CWE-321
The product uses a hard-coded, unchangeable cryptographic key.
We track 210 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
Latest Use of Hard-coded Cryptographic Key vulnerabilities
- 7.5 High severity
Setracker2 Parental Control App (Android)…: Use of Hard-coded Cryptographic Key
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
- 8.1 High severity
NF20MESH: Use of Hard-coded Cryptographic Key
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web ma
- 7.1 High severity
Wertheim SafeController Family 65000 Hardware…: Use of Hard-coded Cryptographic Key
The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt
- 9.8 Critical severity
Smart Doorbell X3: Use of Hard-coded Cryptographic Key
Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations d
- 7.4 High severity
com.lumiunited.aqarahome: Use of Hard-coded Credentials
Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/A
- 9.3 Critical severity
haxcms-nodejs: Exposure of Sensitive Information to an Unauthorized Actor
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker t
- 8.5 High severity
linqi: Use of Hard-coded Cryptographic Key
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible.
- 8.7 High severity
GX Earth 2022: Use of Hard-coded Cryptographic Key
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lea
- 8.7 High severity
rustfs: Use of Hard-coded Cryptographic Key
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TEST_PRIVATE_KEY and uses it in production via parse_license() to "verify" license token
- 8.1 High severity
DGX Spark: Use of Hard-coded Cryptographic Key
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned syste
- 9.1 Critical severity
Apache OFBiz: Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- 8.3 High severity
blueplanet 100 NX3 M8: Use of Hard-coded Cryptographic Key
A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions < V3.92), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All versions < V3.
- 8.6 High severity
com.meari.sdk: Use of Hard-coded Cryptographic Key
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport
- 8.7 High severity
e-Sushrut, Hospital Management Information…: Use of Hard-coded Cryptographic Key
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sens
- 7.3 High severity
A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0.
A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptog
- 7.7 High severity
Anviz CX7 Firmware: Use of Hard-coded Cryptographic Key
Anviz CX7 Firmware is vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.
- 9.1 Critical severity
KnowledgeDeliver: Use of Hard-coded Cryptographic Key
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization atta
- 7.5 High severity
Apache OpenMeetings: Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attack
- 7.5 High severity
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01.
A vulnerability was determined in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this issue is some unknown functionality of the file /webroot_ro/pem/privkeySrv.pem of the component RSA 2048-bit Private Key Handler. Executing a manipulation can lead to use of
- 7.3 High severity
Archer NX600 v3.0: Use of Hard-coded Credentials
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-e
- 9.8 Critical severity
WebSphere Application Server - Liberty: Use of Hard-coded Credentials
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
- 8.2 High severity
VVX: Use of Hard-coded Cryptographic Key
An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of t
- 7.8 High severity
UPK: Use of Hard-coded Cryptographic Key
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, su
- 7.5 High severity
10G08-0800GSM Network Switch: Use of Hard-coded Cryptographic Key
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protect
- 9.8 Critical severity
Ruckus Network Director: Use of Hard-coded Cryptographic Key
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authent
- 9.8 Critical severity
VeraSMART: Use of Hard-coded Cryptographic Key
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a val
- 9.8 Critical severity
FUXA: Use of Hard-coded Cryptographic Key
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through ver
- 9.8 Critical severity
0852-1322: Use of Hard-coded Cryptographic Key
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
- 7.8 High severity
SyteLine ERP: Use of Hard-coded Credentials
Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys. The encryption keys are identical across all installations. An attacker with access to the applicat
- 9.8 Critical severity
bambuddy: Missing Authentication for Critical Functionality
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs is checked into source code and ManyAPI routes do not check authentication. This issue has been patche
- 9.8 Critical severity
Marketing Cloud Engagement: Use of Hard-coded Cryptographic Key
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Mark
- 8.1 High severity
sqle: Use of Hard-coded Credentials
A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-code
- 8.1 High severity
siyuan: Use of Hard-coded Credentials
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective
- 7.8 High severity
Device Manager: Use of Hard-coded Cryptographic Key
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in Device Manager that a hardcoded encryption key for sensitive information. An attacker can use
- 9.8 Critical severity
Enterprise Cloud Database: Use of Hard-coded Cryptographic Key
Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.
- 9.8 Critical severity
Apache StreamPark: Use of Hard-coded Credentials
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely conf
- 9.8 Critical severity
WISE-DeviceOn Server: Use of Hard-coded Cryptographic Key
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a
- 7.8 High severity
Circutor: Use of Hard-coded Cryptographic Key
Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key (e.g., by analysing the firmware image or memor
- 7.5 High severity
Apache Syncope: Use of Hard-coded Cryptographic Key
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a
- 8.1 High severity
Twonky Server: Use of Hard-coded Cryptographic Key
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and