目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-321 使用硬编码的密码学密钥 类漏洞列表 290

CWE-321 使用硬编码的密码学密钥 类弱点 290 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-321 指软件在代码中硬编码了不可更改的加密密钥。攻击者通过逆向工程提取该密钥，即可解密受保护数据或伪造合法通信，严重破坏机密性与完整性。开发者应避免此类做法，改用动态密钥管理机制，如从安全密钥库、环境变量或硬件安全模块中运行时获取密钥，确保密钥可轮换且不与源代码一同发布。

MITRE CWE 官方描述
CWE：CWE-321 使用硬编码的加密密钥（Use of Hard-coded Cryptographic Key） 英文：The product uses a hard-coded, unchangeable cryptographic key. 译文：该产品使用了硬编码且不可更改的加密密钥（cryptographic key）。
常见影响 (1)
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data
If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
缓解措施 (1)
Architecture and DesignPrevention schemes mirror that of hard-coded password storage.
代码示例 (2)
The following code examples attempt to verify a password using a hard-coded cryptographic key.
int VerifyAdmin(char *password) { if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }
Bad · C
public boolean VerifyAdmin(String password) { if (password.equals("68af404b513073584c4b6f22b6c63e6b")) { System.out.println("Entering Diagnostic Mode..."); return true; } System.out.println("Incorrect Password!"); return false;
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID标题CVSS风险等级Published
CVE-2025-60250 Unitree多款产品 安全漏洞 — Go2 4.7 Medium2025-09-26
CVE-2025-58069 AutomationDirect CLICK PLUS 安全漏洞 — CLICK PLUS C0-0x CPU firmware 5.3 Medium2025-09-23
CVE-2025-54807 Dover Fueling Solutions多款产品 安全漏洞 — ProGauge MagLink LX 4 9.8 Critical2025-09-18
CVE-2025-55112 BMC Control-M 安全漏洞 — Control-M/Agent 7.4 High2025-09-16
CVE-2025-10250 DJI Mavic 安全漏洞 — Mavic Spark 5.0 Medium2025-09-11
CVE-2025-10080 Datart 安全漏洞 — Datart 3.1 Low2025-09-08
CVE-2025-30198 ECOVACS robot vacuums 安全漏洞 — DEEBOT X1 Series 6.3 Medium2025-09-05
CVE-2025-30200 ECOVACS robot vacuums 安全漏洞 — DEEBOT X1 Series 6.3 Medium2025-09-05
CVE-2025-9604 Coze Studio 安全漏洞 — coze-studio 3.7 Low2025-08-29
CVE-2025-41702 Welotec多款产品 安全漏洞 — EG400Mk2-D11001-000101 9.8 Critical2025-08-26
CVE-2025-8759 TRENDnet TN-200 安全漏洞 — TN-200 3.7 Low2025-08-09
CVE-2025-2810 Dräger ICMHelper 安全漏洞 — Draeger ICMHelper 5.5 Medium2025-08-05
CVE-2025-26476 Dell ECS 安全漏洞 — ECS 8.4 High2025-08-04
CVE-2025-38741 Dell Enterprise SONiC OS 安全漏洞 — Enterprise SONiC OS 7.5 High2025-08-04
CVE-2025-44963 RUCKUS Network Director 安全漏洞 — Network Director 9.0 Critical2025-08-04
CVE-2025-43483 HP Poly Clariti Manager 安全漏洞 — Poly Clariti Manager 7.5 -2025-07-22
CVE-2025-6071 ABB RMC-100 安全漏洞 — RMC-100 5.3 Medium2025-07-03
CVE-2025-6074 ABB RMC-100 安全漏洞 — RMC-100 6.5 Medium2025-07-03
CVE-2025-6669 sublinkX 安全漏洞 — sublinkX 3.7 Low2025-06-25
CVE-2025-5353 Ivanti Workspace Control 安全漏洞 — Workspace Control 8.8 High2025-06-10
CVE-2025-22463 Ivanti Workspace Control 安全漏洞 — Workspace Control 7.3 High2025-06-10
CVE-2025-22455 Ivanti Workspace Control 安全漏洞 — Workspace Control 8.8 High2025-06-10
CVE-2025-49164 Arris VIP1113 安全漏洞 — VIP1113 4.3 Medium2025-06-02
CVE-2025-5164 PerfreeBlog 安全漏洞 — PerfreeBlog 3.7 Low2025-05-26
CVE-2025-48417 eCharge Hardy Barth cPH2和eCharge Hardy Barth cPP2 安全漏洞 — cPH2 / cPP2 charging stations 8.1AIHighAI2025-05-21
CVE-2024-56429 itech iLabClient 安全漏洞 — iLabClient 7.7 High2025-05-21
CVE-2025-4876 ConnectWise Risk Assessment 安全漏洞 — Risk Assessment 6.0 Medium2025-05-19
CVE-2025-45746 ZKTeco ZKBio CVSecurity 安全漏洞 — ZKBio CVSecurity 6.5 Medium2025-05-13
CVE-2024-58134 Mojolicious 安全漏洞 — Mojolicious 7.7AIHighAI2025-05-03
CVE-2025-32730 i-PRO Surveillance Cameras和i-PRO Recorders 安全漏洞 — i-PRO Configuration Tool 7.8 -2025-04-24

CWE-321（使用硬编码的密码学密钥） 是常见的弱点类别，本平台收录该类弱点关联的 290 条 CVE 漏洞。