Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-321 (使用硬编码的密码学密钥) — Vulnerability Class 248

248 vulnerabilities classified as CWE-321 (使用硬编码的密码学密钥). AI Chinese analysis included.

CWE-321 represents a critical implementation weakness where software embeds static, unchangeable cryptographic keys directly into its source code or binary. This flaw severely compromises confidentiality and integrity because attackers can easily extract these keys through reverse engineering or simple code inspection, bypassing the need for complex decryption attacks. Once obtained, adversaries can impersonate legitimate users, decrypt sensitive data, or forge digital signatures with impunity. To mitigate this risk, developers must avoid hardcoding secrets entirely. Instead, they should implement robust key management systems that generate, store, and rotate keys dynamically. Utilizing secure hardware modules, operating system keychains, or dedicated secret management services ensures that cryptographic material remains isolated from the application logic, significantly raising the barrier for potential attackers seeking to compromise the system’s security posture.

MITRE CWE Description
The product uses a hard-coded, unchangeable cryptographic key.
Common Consequences (1)
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data
If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Mitigations (1)
Architecture and DesignPrevention schemes mirror that of hard-coded password storage.
Examples (2)
The following code examples attempt to verify a password using a hard-coded cryptographic key.
int VerifyAdmin(char *password) { if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }
Bad · C
public boolean VerifyAdmin(String password) { if (password.equals("68af404b513073584c4b6f22b6c63e6b")) { System.out.println("Entering Diagnostic Mode..."); return true; } System.out.println("Incorrect Password!"); return false;
Bad · Java
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE IDTitleCVSSSeverityPublished
CVE-2018-0040 Contrail Service Orchestration: hardcoded cryptographic certificates and keys — Contrail Service Orchestration 9.8 -2018-07-11
CVE-2016-9335 Red Lion Controls Sixnet-Managed Industrial Switches和AutomationDirect Stride-Managed Ethernet Switches 安全漏洞 — Sixnet-Managed Industrial Switches 10.0 -2018-05-09
CVE-2017-14014 Boston Scientific ZOOM LATITUDE PRM 3120 信息泄露漏洞 — ZOOM LATITUDE PRM 4.6 -2018-05-01
CVE-2017-14021 多款Korenix产品安全漏洞 — Korenix JetNet 9.8 -2017-11-01
CVE-2017-9649 多款Mirion Technologies产品安全漏洞 — Mirion Technologies Telemetry Enabled Devices 7.5 -2017-09-20
CVE-2017-6054 Hyundai Motor America Blue Link 安全漏洞 — Hyundai Motor America Blue Link 7.5 -2017-04-26
CVE-2014-5403 Hospira MedNet Use of Hard-coded Cryptographic Key — MedNet 5.9 -2015-04-03
CVE-2014-5419 GE Multilink Use of Hard-coded Cryptographic Key — Multilink ML800/1200/1600/2400 5.9 -2015-01-17

Vulnerabilities classified as CWE-321 (使用硬编码的密码学密钥) represent 248 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.