CWE-321 · Use of Hard-coded Cryptographic Key (page 3)
Page 3 of 4 — CVEs classified under CWE-321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-27584 | Critical | 9.8 | 2024-09-19 | Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incub… |
CVE-2024-42418 | High | 7.5 | 2024-08-22 | Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information. |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-41260 | High | 7.5 | 2024-08-01 | A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive inform… |
CVE-2024-20323 | High | 7.5 | 2024-07-17 | A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Man… |
CVE-2024-38532 | High | 7.1 | 2024-06-28 | The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryp… |
CVE-2024-35344 | Critical | 9.9 | 2024-05-28 | Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D3… |
CVE-2024-33849 | Medium | 6.5 | 2024-05-28 | ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. |
CVE-2024-5296 | Critical | 9.8 | 2024-05-23 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2024-31410 | High | 7.7 | 2024-05-15 | The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate… |
CVE-2024-30207 | Critical | 10.0 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-3109 | Medium | 6.3 | 2024-05-03 | A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to… |
CVE-2023-39482 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2023-39465 | High | 7.5 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to d… |
CVE-2023-32169 | Critical | 9.8 | 2024-05-03 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on a… |
CVE-2019-19754 | Medium | 5.7 | 2024-04-30 | HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of al… |
CVE-2019-19753 | Critical | 9.1 | 2024-04-30 | SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all… |
CVE-2019-19752 | Critical | 9.8 | 2024-04-30 | nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4… |
CVE-2024-33891 | High | 8.8 | 2024-04-28 | Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is rela… |
CVE-2024-30407 | High | 8.1 | 2024-04-12 | The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD)… |
CVE-2023-38535 | Medium | 4.7 | 2024-03-13 | Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryp… |
CVE-2024-2413 | Critical | 9.8 | 2024-03-13 | Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timest… |
CVE-2024-1920 | Medium | 5.6 | 2024-02-27 | A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/mi… |
CVE-2024-1631 | Critical | 9.1 | 2024-02-21 | Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w… |
CVE-2022-48625 | High | 7.5 | 2024-02-20 | Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary. |
CVE-2024-1258 | Low | 3.1 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2023-49256 | High | 7.5 | 2024-01-12 | It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key. |
CVE-2023-48392 | Critical | 9.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can gener… |
CVE-2023-40464 | High | 8.1 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items coul… |
CVE-2023-44318 | Medium | 4.9 | 2023-11-14 | Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated… |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-46129 | High | 7.5 | 2023-10-31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptogra… |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-43637 | High | 7.8 | 2023-09-21 | Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfooba… |
CVE-2023-39982 | High | 7.5 | 2023-09-02 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications a… |
CVE-2023-3404 | Medium | 4.9 | 2023-08-31 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to th… |
CVE-2023-32077 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to intera… |
CVE-2023-3632 | Critical | 9.8 | 2023-08-09 | Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authenticati… |
CVE-2023-3947 | Low | 3.7 | 2023-07-26 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_de… |
CVE-2023-37291 | High | 8.6 | 2023-07-21 | Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter… |
CVE-2023-34123 | High | 7.5 | 2023-07-13 | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5… |
CVE-2023-22844 | High | 7.3 | 2023-07-06 | An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request… |
CVE-2023-34338 | High | 7.1 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit… |
CVE-2023-3371 | Medium | 5.3 | 2023-06-27 | The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'dis… |
CVE-2023-2637 | High | 7.3 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lea… |
CVE-2023-21404 | Medium | 5.3 | 2023-05-08 | AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure… |
CVE-2023-2158 | Critical | 9.8 | 2023-04-27 | Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by craf… |
CVE-2023-0391 | High | 8.1 | 2023-03-21 | MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of Clou… |
CVE-2023-27583 | Critical | 9.8 | 2023-03-13 | PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JW… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2023-21705 | High | 8.8 | 2023-02-14 | Microsoft SQL Server Remote Code Execution Vulnerability |
CVE-2022-34386 | Medium | 5.5 | 2023-02-11 | Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnera… |
CVE-2023-20038 | High | 8.8 | 2023-01-20 | A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key u… |
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2022-34441 | High | 8.0 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34440 | High | 8.4 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of t… |
CVE-2022-36925 | Medium | 4.4 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon… |
CVE-2022-2660 | Critical | 9.8 | 2022-12-13 | Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to dec… |
CVE-2022-2641 | Critical | 9.8 | 2022-12-02 | Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2021-4228 | Medium | 5.8 | 2022-10-24 | Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-1400 | High | 7.1 | 2022-08-17 | Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an… |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2022-29186 | Critical | 9.1 | 2022-05-20 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contai… |
CVE-2022-1701 | High | 7.5 | 2022-05-13 | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data. |
CVE-2022-26020 | Medium | 6.5 | 2022-05-12 | An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted netw… |
CVE-2022-20773 | High | 7.5 | 2022-04-21 | A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to imper… |
CVE-2022-24860 | High | 7.4 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An a… |
CVE-2020-25193 | Medium | 5.3 | 2022-03-18 | By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers woul… |
CVE-2020-25180 | Medium | 5.3 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The… |
CVE-2022-23650 | High | 7.2 | 2022-02-18 | Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cry… |
CVE-2022-0664 | Critical | 9.8 | 2022-02-18 | Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. |
CVE-2022-22987 | Critical | 9.8 | 2022-02-04 | The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furth… |
CVE-2022-21199 | Medium | 5.9 | 2022-01-28 | An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle atta… |
CVE-2021-23842 | Medium | 5.7 | 2022-01-19 | Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the… |
CVE-2021-43552 | Medium | 6.1 | 2021-12-27 | The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC i… |
CVE-2021-43587 | High | 8.2 | 2021-12-21 | Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may pot… |
CVE-2021-40119 | Critical | 9.8 | 2021-11-04 | A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected sy… |
CVE-2021-38461 | High | 8.2 | 2021-10-22 | The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries. |
CVE-2021-32520 | Critical | 9.8 | 2021-07-07 | Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contac… |
CVE-2021-27481 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allo… |
CVE-2021-27392 | High | 8.8 | 2021-04-22 | A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open… |
CVE-2021-27389 | Critical | 9.8 | 2021-04-22 | A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the… |
CVE-2021-0266 | High | 8.1 | 2021-04-22 | The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a… |
CVE-2020-7846 | High | 8.0 | 2021-02-24 | Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download an… |
CVE-2020-25173 | High | 7.8 | 2021-01-26 | An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local networ… |
CVE-2020-28395 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variant… |
CVE-2020-28391 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-25234 | High | 7.7 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program fi… |
CVE-2020-25233 | Medium | 5.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices contains the private R… |
CVE-2020-25231 | Medium | 5.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of pr… |
CVE-2020-25229 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communication with affected dev… |