Use of Hard-coded Cryptographic Key
CWE-321
The product uses a hard-coded, unchangeable cryptographic key.
We track 210 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Prevention schemes mirror that of hard-coded password storage.
Latest Use of Hard-coded Cryptographic Key vulnerabilities
- 7.5 High severity
GX Works3: Use of Hard-coded Credentials
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project f
- 8.8 High severity
Cisco Secure Web Appliance: Use of Hard-coded Credentials
A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker n
- 7.5 High severity
Enterprise SONiC OS: Use of Hard-coded Credentials
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication.
- 9.8 Critical severity
CMDB: Use of Hard-coded Credentials
Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior
- 9.8 Critical severity
rundeck: Use of Hard-coded Credentials
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized
- 7.5 High severity
Cisco Umbrella Insights Virtual Appliance: Use of Hard-coded Credentials
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could ex
- 9.8 Critical severity
databasir: Use of Hard-coded Credentials
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service backg
- 8.8 High severity
netmaker: Use of Hard-coded Credentials
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if th
- 9.8 Critical severity
ADAM-3600: Use of Hard-coded Credentials
The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
- 9.8 Critical severity
Apache Shiro Code Execution Exploited
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.