CWE-321

Use of Hard-coded Cryptographic Key

Variant

Draft

The product uses a hard-coded, unchangeable cryptographic key.

Parent Weaknesses (ChildOf)

Scope

Access Control

Impact

Bypass Protection Mechanism, Gain Privileges or Assume Identity, Read Application Data

Architecture and Design

Prevention schemes mirror that of hard-coded password storage.

Engineering Workstation uses hard-coded cryptographic keys that could allow for unathorized filesystem access and privilege escalation

Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used by default.

WiFi router service has a hard-coded encryption key, allowing root access

Communications / collaboration product has a hardcoded SSH private key, allowing access to root account

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.