CWE-321 · Use of Hard-coded Cryptographic Key (page 3)
Page 3 of 5 — CVEs classified under CWE-321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56802 | Medium | 5.1 | 2025-10-21 | The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access t… |
CVE-2025-56801 | Medium | 5.1 | 2025-10-21 | The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing atta… |
CVE-2025-11899 | High | 8.1 | 2025-10-17 | Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to… |
CVE-2025-58426 | Medium | 4.3 | 2025-10-16 | desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications. |
CVE-2025-11609 | Low | 3.7 | 2025-10-11 | A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of… |
CVE-2025-35052 | Medium | 5.3 | 2025-10-09 | Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, po… |
CVE-2025-11290 | Medium | 5.6 | 2025-10-05 | A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argume… |
CVE-2025-59407 | Critical | 9.8 | 2025-10-02 | The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and… |
CVE-2025-24525 | High | 7.5 | 2025-09-30 | Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via A… |
CVE-2025-34217 | Critical | 9.8 | 2025-09-30 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded… |
CVE-2025-8625 | Critical | 9.8 | 2025-09-30 | The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin fall… |
CVE-2025-34234 | High | 7.5 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34215 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose… |
CVE-2025-34211 | Medium | 4.9 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) con… |
CVE-2025-36326 | Low | 3.7 | 2025-09-26 | IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of… |
CVE-2025-60250 | Medium | 4.7 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d… |
CVE-2025-58069 | Medium | 5.3 | 2025-09-23 | The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software… |
CVE-2025-54807 | Critical | 9.8 | 2025-09-18 | The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypas… |
CVE-2025-55112 | High | 7.4 | 2025-09-16 | Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cry… |
CVE-2025-57174 | Critical | 9.8 | 2025-09-15 | An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rf… |
CVE-2025-10250 | Medium | 5.0 | 2025-09-11 | A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Exe… |
CVE-2025-10080 | Low | 3.1 | 2025-09-08 | A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/sr… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-56577 | High | 8.4 | 2025-08-29 | An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. |
CVE-2025-9604 | Low | 3.7 | 2025-08-29 | A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The ma… |
CVE-2025-41702 | Critical | 9.8 | 2025-08-26 | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 toke… |
CVE-2025-55619 | Critical | 9.8 | 2025-08-22 | Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decry… |
CVE-2025-8759 | Low | 3.7 | 2025-08-09 | A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. T… |
CVE-2025-2810 | Medium | 5.5 | 2025-08-05 | A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key. |
CVE-2025-38741 | High | 7.5 | 2025-08-04 | Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this v… |
CVE-2025-26476 | High | 8.4 | 2025-08-04 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with… |
CVE-2025-44963 | Critical | 9.0 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. |
CVE-2025-43483 | Medium | 5.7 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval o… |
CVE-2025-52374 | Medium | 4.6 | 2025-07-21 | Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.e… |
CVE-2025-52373 | Medium | 4.6 | 2025-07-21 | Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from h… |
CVE-2025-6074 | Medium | 6.5 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains ac… |
CVE-2025-6071 | Medium | 5.3 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT informa… |
CVE-2025-6669 | Low | 3.7 | 2025-06-25 | A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewar… |
CVE-2025-5353 | High | 8.8 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. |
CVE-2025-22463 | High | 7.3 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. |
CVE-2025-22455 | High | 8.8 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. |
CVE-2025-49164 | Medium | 4.3 | 2025-06-03 | Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a. |
CVE-2025-5164 | Low | 3.7 | 2025-05-26 | A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handle… |
CVE-2024-56429 | High | 7.7 | 2025-05-21 | itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database. |
CVE-2025-48417 | Medium | 6.5 | 2025-05-21 | The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware a… |
CVE-2025-4876 | Medium | 6.0 | 2025-05-19 | ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering… |
CVE-2025-45746 | Medium | 6.5 | 2025-05-13 | In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Su… |
CVE-2024-58134 | High | 8.1 | 2025-05-03 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These pred… |
CVE-2025-32730 | Medium | 5.5 | 2025-04-24 | Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance cameras and recorders… |
CVE-2025-30206 | Critical | 9.8 | 2025-04-15 | Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its de… |
CVE-2025-31362 | Low | 3.7 | 2025-04-11 | Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available. … |
CVE-2025-3177 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipul… |
CVE-2025-30406 | Critical | 9.0 | 2025-04-03 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machine… |
CVE-2025-30095 | Critical | 9.0 | 2025-03-31 | VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across d… |
CVE-2025-30234 | High | 8.3 | 2025-03-19 | SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone imag… |
CVE-2024-54027 | High | 8.2 | 2025-03-17 | A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, versio… |
CVE-2024-13773 | High | 7.3 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2025-27674 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006. |
CVE-2025-26340 | High | 8.8 | 2025-02-12 | A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote atta… |
CVE-2024-33504 | Medium | 4.1 | 2025-02-11 | A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through… |
CVE-2024-13842 | Medium | 6.0 | 2025-02-11 | A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with ad… |
CVE-2024-28989 | Medium | 5.5 | 2025-02-11 | SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software. |
CVE-2025-1099 | | 2025-02-10 | This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access cou… | |
CVE-2024-52881 | High | 7.5 | 2025-02-07 | An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sen… |
CVE-2024-47256 | Medium | 6.0 | 2025-02-06 | Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may b… |
CVE-2024-12078 | Medium | 6.3 | 2025-01-23 | ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control an… |
CVE-2024-50564 | Low | 3.3 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a… |
CVE-2023-37936 | Critical | 9.8 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0… |
CVE-2024-5722 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2024-45837 | Medium | 5.4 | 2024-11-22 | Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may… |
CVE-2024-52614 | Medium | 4.0 | 2024-11-20 | Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. If this vulnerability is e… |
CVE-2024-11308 | Medium | 6.2 | 2024-11-18 | The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content. |
CVE-2024-46889 | Medium | 5.3 | 2024-11-12 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obf… |
CVE-2024-10920 | Low | 3.1 | 2024-11-06 | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal… |
CVE-2024-38314 | Medium | 5.9 | 2024-10-24 | IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker… |
CVE-2024-20280 | Medium | 6.3 | 2024-10-16 | A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is… |
CVE-2024-20350 | High | 7.5 | 2024-09-25 | A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco C… |
CVE-2024-46612 | Critical | 9.8 | 2024-09-25 | IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information. |
CVE-2023-27584 | Critical | 9.8 | 2024-09-19 | Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incub… |
CVE-2024-42418 | High | 7.5 | 2024-08-22 | Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information. |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-41260 | High | 7.5 | 2024-08-01 | A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive inform… |
CVE-2024-20323 | High | 7.5 | 2024-07-17 | A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Man… |
CVE-2024-38532 | High | 7.1 | 2024-06-28 | The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryp… |
CVE-2024-35344 | Critical | 9.9 | 2024-05-28 | Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D3… |
CVE-2024-33849 | Medium | 6.5 | 2024-05-28 | ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. |
CVE-2024-5296 | Critical | 9.8 | 2024-05-23 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2024-31410 | High | 7.7 | 2024-05-15 | The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate… |
CVE-2024-30207 | Critical | 10.0 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-3109 | Medium | 6.3 | 2024-05-03 | A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to… |
CVE-2023-39482 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2023-39465 | High | 7.5 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to d… |
CVE-2023-32169 | Critical | 9.8 | 2024-05-03 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2019-19754 | Medium | 5.7 | 2024-04-30 | HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of al… |
CVE-2019-19753 | Critical | 9.1 | 2024-04-30 | SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all… |
CVE-2019-19752 | Critical | 9.8 | 2024-04-30 | nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4… |
CVE-2024-33891 | High | 8.8 | 2024-04-28 | Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is rela… |
CVE-2024-30407 | High | 8.1 | 2024-04-12 | The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD)… |
CVE-2023-38535 | Medium | 4.7 | 2024-03-13 | Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryp… |