CWE-321 Use of Hard-coded Cryptographic Key
variantThe product uses a hard-coded, unchangeable cryptographic key.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (511)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-74233US | critical9.8OT critical | — | ||
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516,… | ||||
| CVE-2025-30406US | critical9.8OT critical | KEV | ||
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited… | ||||
| CVE-2016-4437US | critical9.8OT critical | KEV | ||
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access rest… | ||||
| CVE-2005-2611US | high10.0OT critical | Exploit | ||
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4.5 through 5.1 uses a static p… | ||||
| CVE-2021-40859US | critical9.8OT high | Exploit | ||
Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to t… | ||||
| CVE-2020-10884US | high8.8OT high | Exploit | ||
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is no… | ||||
| CVE-2023-27584US | critical9.8OT high | — | ||
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project.… | ||||
| CVE-2026-89026US | critical9.8OT high | Exploit | ||
The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is ide… | ||||
| CVE-2026-26335US | critical9.8OT high | Exploit | ||
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\Ve… | ||||
| CVE-2026-28326US | high8.8OT high | Exploit | ||
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key. | ||||
| CVE-2020-1764US | high8.6OT high | Exploit | ||
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating… | ||||
| CVE-2013-0137US | high10.0OT high | — | ||
The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private k… | ||||
| CVE-2025-13316US | high8.1OT elevated | Exploit | ||
Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator pass… | ||||
| CVE-2000-0762US | high10.0OT elevated | — | ||
The default installation of eTrust Access Control (formerly SeOS) uses a default encryption key, which allows remote attackers to spoof the eTrust administrator and gain privileges… | ||||
| CVE-1999-0570US | high10.0OT elevated | — | ||
Windows NT is not using a password filter utility, e.g. PASSFILT.DLL. | ||||
| CVE-2020-6990US | critical9.8OT elevated | — | ||
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior… | ||||
| CVE-2016-9335US | critical10.0OT elevated | — | ||
A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Swi… | ||||
| CVE-2001-1106US | high7.5OT elevated | Exploit | ||
The default configuration of Sambar Server 5 and earlier uses a symmetric key that is compiled into the binary program for encrypting passwords, which could allow local users to br… | ||||
| CVE-2025-69971US | critical9.8OT elevated | — | ||
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remo… | ||||
| CVE-2024-25731US | high7.5OT elevated | Exploit | ||
The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be def… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan