CWE-321 · Use of Hard-coded Cryptographic Key (page 4)
Page 4 of 5 — CVEs classified under CWE-321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2413 | Critical | 9.8 | 2024-03-13 | Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timest… |
CVE-2024-1920 | Medium | 5.6 | 2024-02-27 | A vulnerability, which was classified as critical, has been found in osuuu LightPicture up to 1.2.2. This issue affects the function handle of the file /app/mi… |
CVE-2024-1631 | Critical | 9.1 | 2024-02-21 | Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, w… |
CVE-2022-48625 | High | 7.5 | 2024-02-20 | Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary. |
CVE-2024-1258 | Low | 3.1 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2023-49256 | High | 7.5 | 2024-01-12 | It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key. |
CVE-2023-48392 | Critical | 9.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can gener… |
CVE-2023-40464 | High | 8.1 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items coul… |
CVE-2023-44318 | Medium | 4.9 | 2023-11-14 | Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated… |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-46129 | High | 7.5 | 2023-10-31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptogra… |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-43637 | High | 7.8 | 2023-09-21 | Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfooba… |
CVE-2023-39982 | High | 7.5 | 2023-09-02 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications a… |
CVE-2023-3404 | Medium | 4.9 | 2023-08-31 | The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to th… |
CVE-2023-32077 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to intera… |
CVE-2023-3632 | Critical | 9.8 | 2023-08-09 | Use of Hard-coded Cryptographic Key vulnerability in Sifir Bes Education and Informatics Kunduz - Homework Helper App allows Authentication Abuse, Authenticati… |
CVE-2023-3947 | Low | 3.7 | 2023-07-26 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_de… |
CVE-2023-37291 | High | 8.6 | 2023-07-21 | Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter… |
CVE-2023-34123 | High | 7.5 | 2023-07-13 | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5… |
CVE-2023-22844 | High | 7.3 | 2023-07-06 | An authentication bypass vulnerability exists in the requestHandlers.js verifyToken functionality of Milesight VPN v2.0.2. A specially-crafted network request… |
CVE-2023-34338 | High | 7.1 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit… |
CVE-2023-3371 | Medium | 5.3 | 2023-06-27 | The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'dis… |
CVE-2023-2637 | High | 7.3 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lea… |
CVE-2023-21404 | Medium | 5.3 | 2023-05-08 | AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure… |
CVE-2023-2158 | Critical | 9.8 | 2023-04-27 | Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by craf… |
CVE-2023-0391 | High | 8.1 | 2023-03-21 | MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of Clou… |
CVE-2023-27583 | Critical | 9.8 | 2023-03-13 | PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JW… |
CVE-2023-20016 | Medium | 6.3 | 2023-02-23 | A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an… |
CVE-2023-21705 | High | 8.8 | 2023-02-14 | Microsoft SQL Server Remote Code Execution Vulnerability |
CVE-2022-34386 | Medium | 5.5 | 2023-02-11 | Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnera… |
CVE-2023-20038 | High | 8.8 | 2023-01-20 | A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key u… |
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2017-5242 | High | 7.7 | 2023-01-12 | Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key… |
CVE-2022-34441 | High | 8.0 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34440 | High | 8.4 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of t… |
CVE-2022-36925 | Medium | 4.4 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon… |
CVE-2022-2660 | Critical | 9.8 | 2022-12-13 | Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to dec… |
CVE-2022-2641 | Critical | 9.8 | 2022-12-02 | Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2021-4228 | Medium | 5.8 | 2022-10-24 | Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-1400 | High | 7.1 | 2022-08-17 | Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an… |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2022-29186 | Critical | 9.1 | 2022-05-20 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contai… |
CVE-2022-1701 | High | 7.5 | 2022-05-13 | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data. |
CVE-2022-26020 | Medium | 6.5 | 2022-05-12 | An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted netw… |
CVE-2022-20773 | High | 7.5 | 2022-04-21 | A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to imper… |
CVE-2022-24860 | High | 7.4 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An a… |
CVE-2020-25193 | Medium | 5.3 | 2022-03-18 | By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers woul… |
CVE-2020-25180 | Medium | 5.3 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The… |
CVE-2022-23650 | High | 7.2 | 2022-02-18 | Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cry… |
CVE-2022-0664 | Critical | 9.8 | 2022-02-18 | Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. |
CVE-2022-22987 | Critical | 9.8 | 2022-02-04 | The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furth… |
CVE-2022-21199 | Medium | 5.9 | 2022-01-28 | An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle atta… |
CVE-2021-23842 | Medium | 5.7 | 2022-01-19 | Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the… |
CVE-2021-43552 | Medium | 6.1 | 2021-12-27 | The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from the Patient Information Center iX (PIC i… |
CVE-2021-43587 | High | 8.2 | 2021-12-21 | Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged malicious user may pot… |
CVE-2021-40119 | Critical | 9.8 | 2021-11-04 | A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected sy… |
CVE-2021-38461 | High | 8.2 | 2021-10-22 | The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries. |
CVE-2021-32520 | Critical | 9.8 | 2021-07-07 | Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contac… |
CVE-2021-27481 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allo… |
CVE-2021-27392 | High | 8.8 | 2021-04-22 | A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open… |
CVE-2021-27389 | Critical | 9.8 | 2021-04-22 | A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the… |
CVE-2021-0266 | High | 8.1 | 2021-04-22 | The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a… |
CVE-2020-7846 | High | 8.0 | 2021-02-24 | Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download an… |
CVE-2020-25173 | High | 7.8 | 2021-01-26 | An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local networ… |
CVE-2020-28395 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variant… |
CVE-2020-28391 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-25234 | High | 7.7 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The LOGO! program fi… |
CVE-2020-25233 | Medium | 5.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The firmware update of affected devices contains the private R… |
CVE-2020-25231 | Medium | 5.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of pr… |
CVE-2020-25229 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communication with affected dev… |
CVE-2020-25688 | Low | 3.5 | 2020-11-23 | A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the sour… |
CVE-2019-17098 | Low | 3.5 | 2020-09-30 | Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload con… |
CVE-2020-2500 | Critical | 9.8 | 2020-07-01 | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP… |
CVE-2020-1764 | High | 8.6 | 2020-03-26 | A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse… |
CVE-2020-10884 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers… |
CVE-2020-6979 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential… |
CVE-2020-6983 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic… |
CVE-2020-6990 | Critical | 9.8 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2019-5137 | High | 7.5 | 2020-02-25 | The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa… |
CVE-2019-19750 | Critical | 9.8 | 2019-12-12 | minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product. |
CVE-2019-13929 | Medium | 6.5 | 2019-10-10 | A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC… |
CVE-2019-10963 | Medium | 4.3 | 2019-10-08 | Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive i… |
CVE-2019-10990 | Medium | 6.5 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-10920 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via por… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-10896 | High | 7.1 | 2018-08-01 | The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some en… |
CVE-2018-0040 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network… |
CVE-2016-9335 | Critical | 10.0 | 2018-05-09 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride… |
CVE-2017-14014 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removable media. CVSS v3 ba… |
CVE-2017-14021 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4… |