CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
503 vulnerabilities reference this CWE, most recent first.
GHSA-8PX6-9GMX-37G4
Vulnerability from github – Published: 2025-08-22 18:31 – Updated: 2025-08-26 15:30Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
{
"affected": [],
"aliases": [
"CVE-2025-55619"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-22T17:15:32Z",
"severity": "CRITICAL"
},
"details": "Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.",
"id": "GHSA-8px6-9gmx-37g4",
"modified": "2025-08-26T15:30:56Z",
"published": "2025-08-22T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25173"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55619"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/321.html"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/329.html"
},
{
"type": "WEB",
"url": "https://developer.android.com/reference/kotlin/androidx/security/crypto/EncryptedSharedPreferences"
},
{
"type": "WEB",
"url": "https://relieved-knuckle-264.notion.site/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0"
},
{
"type": "WEB",
"url": "https://www.notion.so/Reolink-Android-App-Uses-Hardcoded-AES-Key-and-IV-for-Sensitive-Data-Decryption-21a43700364280dc95bedcf6ac1a5db0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8RGX-FMM3-3QVV
Vulnerability from github – Published: 2025-02-12 15:31 – Updated: 2025-02-12 15:31A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2025-26340"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:33Z",
"severity": "HIGH"
},
"details": "A CWE-321 \"Use of Hard-coded Cryptographic Key\" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.",
"id": "GHSA-8rgx-fmm3-3qvv",
"modified": "2025-02-12T15:31:59Z",
"published": "2025-02-12T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26340"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26340"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8VH6-M67F-4H33
Vulnerability from github – Published: 2025-03-31 15:30 – Updated: 2025-04-11 15:32VyOS 1.3 through 1.5 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run "rm -f /etc/dropbear/key" and/or "rm -f /etc/dropbear-initramfs/key" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.
{
"affected": [],
"aliases": [
"CVE-2025-30095"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T15:15:44Z",
"severity": "CRITICAL"
},
"details": "VyOS 1.3 through 1.5 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS, this is not the default configuration for the system SSH daemon, but is for the console service. To mitigate this, one can run \"rm -f /etc/dropbear/*key*\" and/or \"rm -f /etc/dropbear-initramfs/*key*\" and then dropbearkey -t rsa -s 4096 -f /etc/dropbear_rsa_host_key and reload the service or reboot the system before using Dropbear as the SSH daemon (this clears out all keys mistakenly built into the release image) or update to the latest version of VyOS 1.4 or 1.5. Note that this vulnerability is not unique to VyOS and may appear in any Debian-based Linux distribution that uses Dropbear in combination with live-build, which has a safeguard against this behavior in OpenSSH but no equivalent one for Dropbear.",
"id": "GHSA-8vh6-m67f-4h33",
"modified": "2025-04-11T15:32:26Z",
"published": "2025-03-31T15:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30095"
},
{
"type": "WEB",
"url": "https://blog.vyos.io/vyos-project-march-2025-update"
},
{
"type": "WEB",
"url": "https://blog.vyos.io/vyos-stream-1.5-2025-q1"
},
{
"type": "WEB",
"url": "https://github.com/vyos"
},
{
"type": "WEB",
"url": "https://vyos.dev/T7217"
},
{
"type": "WEB",
"url": "https://vyos.net/get/stream/#1.5-2025-Q1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8X8H-HCQ8-JWWX
Vulnerability from github – Published: 2023-08-25 18:38 – Updated: 2026-05-19 16:06Impact
Hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.
Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+.
If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users
If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.
Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.
References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gravitl/netmaker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/gravitl/netmaker"
},
"ranges": [
{
"events": [
{
"introduced": "0.18.0"
},
{
"fixed": "0.18.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32077"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-25T18:38:18Z",
"nvd_published_at": "2023-08-24T22:15:08Z",
"severity": "HIGH"
},
"details": "### Impact \nHardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.\n\n### Patches\nIssue is patched in 0.17.1, and fixed in 0.18.6+. \n\nIf Users are using 0.17.1, they should run \"docker pull gravitl/netmaker:v0.17.1\" and \"docker-compose up -d\". This will switch them to the patched users\n\nIf users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.\n\n### Workarounds\nIf using 0.17.1, can just pull the latest docker image of backend and restart server.\n\n### References\nCredit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery",
"id": "GHSA-8x8h-hcq8-jwwx",
"modified": "2026-05-19T16:06:30Z",
"published": "2023-08-25T18:38:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32077"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/pull/2170"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657"
},
{
"type": "PACKAGE",
"url": "https://github.com/gravitl/netmaker"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Netmaker has Hardcoded DNS Secret Key"
}
GHSA-99HF-385J-MP2J
Vulnerability from github – Published: 2025-08-04 21:30 – Updated: 2025-08-04 21:30Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2025-26476"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T19:15:30Z",
"severity": "HIGH"
},
"details": "Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.",
"id": "GHSA-99hf-385j-mp2j",
"modified": "2025-08-04T21:30:42Z",
"published": "2025-08-04T21:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26476"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000339134/dsa-2025-154-security-update-for-dell-ecs-and-objectscale-use-of-hard-coded-ssh-cryptographic-key-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-99WF-F9RF-JH8P
Vulnerability from github – Published: 2026-02-27 06:31 – Updated: 2026-02-27 06:31Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
{
"affected": [],
"aliases": [
"CVE-2026-1442"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T05:18:18Z",
"severity": "HIGH"
},
"details": "Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree\u2019s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner\u2019s knowledge.",
"id": "GHSA-99wf-f9rf-jh8p",
"modified": "2026-02-27T06:31:28Z",
"published": "2026-02-27T06:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1442"
},
{
"type": "WEB",
"url": "https://github.com/Bin4ry/UniTEABag"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4D"
},
{
"type": "WEB",
"url": "https://x.com/bin4rydigit/status/2027197985625420242"
},
{
"type": "WEB",
"url": "http://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9M28-7Q5Q-GCH7
Vulnerability from github – Published: 2025-02-07 18:31 – Updated: 2025-02-10 18:30An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
{
"affected": [],
"aliases": [
"CVE-2024-52881"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-07T16:15:36Z",
"severity": "HIGH"
},
"details": "An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.",
"id": "GHSA-9m28-7q5q-gch7",
"modified": "2025-02-10T18:30:46Z",
"published": "2025-02-07T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52881"
},
{
"type": "WEB",
"url": "https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-079.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9PPG-RG73-3244
Vulnerability from github – Published: 2026-06-26 00:32 – Updated: 2026-06-26 00:32Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
{
"affected": [],
"aliases": [
"CVE-2026-9220"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T00:16:55Z",
"severity": "HIGH"
},
"details": "Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.",
"id": "GHSA-9ppg-rg73-3244",
"modified": "2026-06-26T00:32:07Z",
"published": "2026-06-26T00:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9220"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9R9G-GV68-X7HW
Vulnerability from github – Published: 2023-11-09 15:30 – Updated: 2023-11-09 15:30Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
{
"affected": [],
"aliases": [
"CVE-2023-41137"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-09T15:15:08Z",
"severity": "HIGH"
},
"details": "Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.",
"id": "GHSA-9r9g-gv68-x7hw",
"modified": "2023-11-09T15:30:30Z",
"published": "2023-11-09T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41137"
},
{
"type": "WEB",
"url": "https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9V35-4XCR-W9PH
Vulnerability from github – Published: 2024-08-01 18:32 – Updated: 2025-12-16 23:31A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/netbirdio/netbird"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.2"
},
{
"fixed": "0.29.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41260"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-07T14:16:58Z",
"nvd_published_at": "2024-08-01T16:15:06Z",
"severity": "HIGH"
},
"details": "A static initialization vector (IV) in the encrypt function of netbird management\u0027s service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.",
"id": "GHSA-9v35-4xcr-w9ph",
"modified": "2025-12-16T23:31:03Z",
"published": "2024-08-01T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41260"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/issues/2246"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/5714"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/pull/2569"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-9v35-4xcr-w9ph"
},
{
"type": "PACKAGE",
"url": "https://github.com/netbirdio/netbird"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NetBird uses a static initialization vector (IV)"
}
Mitigation
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.