Common Weakness Enumeration
CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
583 vulnerabilities reference this CWE, most recent first.
GHSA-96QV-R2X5-FFCH
Vulnerability from github – Published: 2026-08-07 12:32 – Updated: 2026-09-07 15:33
VLAI
Details
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-54218"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T10:16:59Z",
"severity": "HIGH"
},
"details": "Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid\u0027s Webbox. For users created locally in David, passwords are stored in various \nfiles using only obfuscation. Any user with access to the server\u2019s file \nsystem, or who can otherwise extract files from the server (see \nvulnerability\u00a0\u201cRandom File Read\u201d), can potentially obtain affected \nusers\u2019 passwords.\u00a0This issue affects TeamDavid through Rollout 524.",
"id": "GHSA-96qv-r2x5-ffch",
"modified": "2026-09-07T15:33:45Z",
"published": "2026-08-07T12:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54218"
},
{
"type": "WEB",
"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"
},
{
"type": "WEB",
"url": "https://david.tobit.software/releasenotes"
},
{
"type": "WEB",
"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-99HF-385J-MP2J
Vulnerability from github – Published: 2025-08-04 21:30 – Updated: 2025-08-04 21:30
VLAI
Details
Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Severity
8.4 (High)
{
"affected": [],
"aliases": [
"CVE-2025-26476"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T19:15:30Z",
"severity": "HIGH"
},
"details": "Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.",
"id": "GHSA-99hf-385j-mp2j",
"modified": "2025-08-04T21:30:42Z",
"published": "2025-08-04T21:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26476"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000339134/dsa-2025-154-security-update-for-dell-ecs-and-objectscale-use-of-hard-coded-ssh-cryptographic-key-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-99WF-F9RF-JH8P
Vulnerability from github – Published: 2026-02-27 06:31 – Updated: 2026-02-27 06:31
VLAI
Details
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-1442"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T05:18:18Z",
"severity": "HIGH"
},
"details": "Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree\u2019s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner\u2019s knowledge.",
"id": "GHSA-99wf-f9rf-jh8p",
"modified": "2026-02-27T06:31:28Z",
"published": "2026-02-27T06:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1442"
},
{
"type": "WEB",
"url": "https://github.com/Bin4ry/UniTEABag"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/posts/kevin-finisterre-6431069a_in-case-you-want-to-teabag-unitree-robotics-activity-7432984361014091776-zB4D"
},
{
"type": "WEB",
"url": "https://x.com/bin4rydigit/status/2027197985625420242"
},
{
"type": "WEB",
"url": "http://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001111111111110101111111111000000000000000000000000000000000000000000000000000000101"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CJ8-GPP5-QFWF
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33
VLAI
Details
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-80057"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T15:17:32Z",
"severity": "MODERATE"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.",
"id": "GHSA-9cj8-gpp5-qfwf",
"modified": "2026-09-07T15:33:55Z",
"published": "2026-09-07T15:33:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80057"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9F5F-7WXJ-73G8
Vulnerability from github – Published: 2026-08-11 00:31 – Updated: 2026-08-11 00:31
VLAI
Details
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data.
Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-30239"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T23:16:50Z",
"severity": "HIGH"
},
"details": "In affected TP-Link Aginet devices, use of\nhardcoded cryptographic keys embedded in the firmware to protect sensitive\nconfiguration data may allow an attacker who has access to device storage to\nrecover the keys and decrypt stored data.\n\n\n\n\n\nSuccessful\nexploitation may allow access to decrypted sensitive configuration data,\nincluding credentials and service-related information.",
"id": "GHSA-9f5f-7wxj-73g8",
"modified": "2026-08-11T00:31:12Z",
"published": "2026-08-11T00:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30239"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/faq/5239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9FGV-5XJR-4M27
Vulnerability from github – Published: 2026-09-09 18:32 – Updated: 2026-09-09 18:32
VLAI
Details
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-79735"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T16:17:07Z",
"severity": "MODERATE"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.",
"id": "GHSA-9fgv-5xjr-4m27",
"modified": "2026-09-09T18:32:03Z",
"published": "2026-09-09T18:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79735"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9M28-7Q5Q-GCH7
Vulnerability from github – Published: 2025-02-07 18:31 – Updated: 2025-02-10 18:30
VLAI
Details
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-52881"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-07T16:15:36Z",
"severity": "HIGH"
},
"details": "An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.",
"id": "GHSA-9m28-7q5q-gch7",
"modified": "2025-02-10T18:30:46Z",
"published": "2025-02-07T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52881"
},
{
"type": "WEB",
"url": "https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-079.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9PPG-RG73-3244
Vulnerability from github – Published: 2026-06-26 00:32 – Updated: 2026-06-26 00:32
VLAI
Details
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-9220"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T00:16:55Z",
"severity": "HIGH"
},
"details": "Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.",
"id": "GHSA-9ppg-rg73-3244",
"modified": "2026-06-26T00:32:07Z",
"published": "2026-06-26T00:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9220"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/VA/white/2026/va-26-176-01.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9R9G-GV68-X7HW
Vulnerability from github – Published: 2023-11-09 15:30 – Updated: 2023-11-09 15:30
VLAI
Details
Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.
Severity
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2023-41137"
],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-09T15:15:08Z",
"severity": "HIGH"
},
"details": "Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate the AppsAnywhere server.",
"id": "GHSA-9r9g-gv68-x7hw",
"modified": "2023-11-09T15:30:30Z",
"published": "2023-11-09T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41137"
},
{
"type": "WEB",
"url": "https://docs.appsanywhere.com/appsanywhere/3.1/2023-11-security-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9V35-4XCR-W9PH
Vulnerability from github – Published: 2024-08-01 18:32 – Updated: 2025-12-16 23:31
VLAI
Summary
NetBird uses a static initialization vector (IV)
Details
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/netbirdio/netbird"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.2"
},
{
"fixed": "0.29.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41260"
],
"database_specific": {
"cwe_ids": [
"CWE-321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-07T14:16:58Z",
"nvd_published_at": "2024-08-01T16:15:06Z",
"severity": "HIGH"
},
"details": "A static initialization vector (IV) in the encrypt function of netbird management\u0027s service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.",
"id": "GHSA-9v35-4xcr-w9ph",
"modified": "2025-12-16T23:31:03Z",
"published": "2024-08-01T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41260"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/issues/2246"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/5714"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/pull/2569"
},
{
"type": "WEB",
"url": "https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-9v35-4xcr-w9ph"
},
{
"type": "PACKAGE",
"url": "https://github.com/netbirdio/netbird"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NetBird uses a static initialization vector (IV)"
}
Mitigation
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.