CWE-321 · Cryptography
Use of Hard-coded Cryptographic Key
436CVEs
2exploited
4with a public check
3likely (EPSS 10%+)
SortMost likely exploited
436 CVEs with CWE-321 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-30406In CISA KEVExploitedGladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCEGladinet · CentreStack · CVSS 9 · 2025-04-03 | 9.0 | 95% | 2025-04-03 |
| CVE-2016-4437In CISA KEVExploitedApache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution VulnerabilityApache · Shiro · CVSS 9.8 · 2016-06-07 | 9.8 | 93% | 2016-06-07 |
| CVE-2023-27584CheckDragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secretdragonflyoss · Dragonfly2 · CVSS 9.8 · 2024-09-19 | 9.8 | 34% | 2024-09-19 |
| CVE-2023-32077CheckNetmaker - Hardcoded DNS Secret Keygravitl · netmaker · CVSS 7.5 · 2023-08-24 | 7.5 | 3.5% | 2023-08-24 |
| CVE-2026-89026CheckIssabel Framework - Hard-Coded PBX API JWT KeyIssabel Foundation · Issabel Framework · CVSS 9.8 · 2026-09-15 | 9.8 | 2.7% | 2026-09-15 |
| CVE-2026-116747CheckKener - Authentication Bypassrajnandan1 · kener · CVSS 8.1 · 2026-10-26 | 8.1 | 2.1% | 2026-10-26 |
| CVE-2023-32169D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityD-Link · D-View · CVSS 9.8 · 2024-05-03 | 9.8 | 56% | 2024-05-03 |
| CVE-2020-10884This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is n…TP-Link · Archer A7 · CVSS 8.1 · 2020-03-25 | 8.1 | 39% | 2020-03-25 |
| CVE-2021-4228Hard-coded TLS CertificateLanner Inc · IAC-AST2500A · CVSS 5.8 · 2022-10-24 | 5.8 | 10% | 2022-10-24 |
| CVE-2019-10963Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosur…Moxa · Moxa EDR 810 · 2019-10-08 | – | 6.5% | 2019-10-08 |
| CVE-2020-6990Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prio…Rockwellautomation · Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Ser… · CVSS 9.8 · 2020-03-16 | 9.8 | 5.9% | 2020-03-16 |
| CVE-2022-1701SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.SonicWall · SonicWall SMA1000 · 2022-05-13 | – | 4.8% | 2022-05-13 |
| CVE-2020-1764A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creatin…Red Hat · kiali · CVSS 8.6 · 2020-03-26 | 8.6 | 3.5% | 2020-03-26 |
| CVE-2026-74233Zbtlink MQWrt infosrvd Command InjectionZbtlink · WE1326 · CVSS 9.8 · 2026-08-27 | 9.8 | 3.4% | 2026-08-27 |
| CVE-2026-26335Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCECalero · VeraSMART · CVSS 9.3 · 2026-02-13 | 9.3 | 3.0% | 2026-02-13 |
| CVE-2025-13316Hard-coded encryption keys in Twonky ServerLynxtechnology · Twonky Server · CVSS 8.2 · 2025-11-19 | 8.2 | 2.8% | 2025-11-19 |
| CVE-2026-86708Sensitive data exposureZohocorp · ManageEngine Applications Manager · CVSS 10 · 2026-09-23 | 10.0 | 2.7% | 2026-09-23 |
| CVE-2021-40119Cisco Policy Suite Static SSH Keys VulnerabilityCisco · Cisco Policy Suite (CPS) Software · CVSS 9.8 · 2021-11-04 | 9.8 | 2.5% | 2021-11-04 |
| CVE-2014-5419GE Multilink Use of Hard-coded Cryptographic KeyGE · Multilink ML800/1200/1600/2400 · CVSS 10 · 2015-01-17 | 10.0 | 2.4% | 2015-01-17 |
| CVE-2019-5137The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa AWK-3131A firmware v…Moxa · Moxa · CVSS 7.5 · 2020-02-25 | 7.5 | 2.3% | 2020-02-25 |
| CVE-2025-57174An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listen…No vendor recorded · CVSS 9.8 · 2025-09-15 | 9.8 | 2.2% | 2025-09-15 |
| CVE-2017-6054A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption password to protect sen…Hyundai · Hyundai Motor America Blue Link · 2017-04-26 | – | 2.1% | 2017-04-26 |
| CVE-2017-14021A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R versi…Korenix · Korenix JetNet · 2017-11-01 | – | 1.9% | 2017-11-01 |
| CVE-2022-0664Use of Hard-coded Cryptographic Key in gravitl/netmakergravitl · gravitl/netmaker · CVSS 8.8 · 2022-02-18 | 8.8 | 1.7% | 2022-02-18 |
| CVE-2014-5403Hospira MedNet Use of Hard-coded Cryptographic KeyHospira · MedNet · CVSS 6.8 · 2015-04-03 | 6.8 | 1.7% | 2015-04-03 |
| CVE-2022-24860Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.vran-dev · databasir · CVSS 7.4 · 2022-04-19 | 7.4 | 1.7% | 2022-04-19 |
| CVE-2022-23650Use of Hard-coded Cryptographic Key in Netmakergravitl · netmaker · CVSS 7.2 · 2022-02-18 | 7.2 | 1.6% | 2022-02-18 |
| CVE-2016-9335A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Sw…Red Lion Controls · Sixnet-Managed Industrial Switches · 2018-05-09 | – | 1.5% | 2018-05-09 |
| CVE-2019-10920A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be…Siemens · LOGO! 8 BM (incl. SIPLUS variants) · 2019-05-14 | – | 1.5% | 2019-05-14 |
| CVE-2020-6983In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic key, which increases…Moxa · Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Ve… · 2020-03-24 | – | 1.5% | 2020-03-24 |
| CVE-2020-6979In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can be recover…Moxa · Moxa EDS-G516E Series firmware, Version 5.2 or lower · 2020-03-24 | – | 1.5% | 2020-03-24 |
| CVE-2018-0040Contrail Service Orchestration: hardcoded cryptographic certificates and keysJuniper Networks · Contrail Service Orchestration · CVSS 9.8 · 2018-07-11 | 9.8 | 1.4% | 2018-07-11 |
| CVE-2022-29830Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions…Mitsubishi Electric Corporation · GX Works3 · CVSS 9.1 · 2022-11-24 | 9.1 | 1.4% | 2022-11-24 |
| CVE-2019-10990Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may…Redlion · Red Lion Controls Crimson (Windows configuration software) · CVSS 6.5 · 2019-09-23 | 6.5 | 1.3% | 2019-09-23 |
| CVE-2017-7574Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to…Schneider-Electric · Somachine · CVSS 10 · 2017-04-06 | 10.0 | 1.3% | 2017-04-06 |
| CVE-2019-13929A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC IT UADM could potent…Siemens AG · SIMATIC IT UADM · 2019-10-10 | – | 1.3% | 2019-10-10 |
| CVE-2021-27392A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (202…Siemens · Siveillance Video Open Network Bridge · 2021-04-22 | – | 1.2% | 2021-04-22 |
| CVE-2023-39482Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure VulnerabilitySofting · Secure Integration Server · CVSS 4.9 · 2024-05-03 | 4.9 | 1.2% | 2024-05-03 |
| CVE-2022-22987Advantech ADAM-3600Advantech · ADAM-3600 · CVSS 9.8 · 2022-02-04 | 9.8 | 1.2% | 2022-02-04 |
| CVE-2022-29186Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterpriserundeck · rundeck · CVSS 9.1 · 2022-05-20 | 9.1 | 1.2% | 2022-05-20 |
| CVE-2020-28395A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V…Siemens · SCALANCE X-200RNA switch family · 2021-01-12 | – | 1.2% | 2021-01-12 |
| CVE-2022-20773Cisco Umbrella Virtual Appliance Static SSH Host Key VulnerabilityCisco · Cisco Umbrella Insights Virtual Appliance · CVSS 7.5 · 2022-04-21 | 7.5 | 1.2% | 2022-04-21 |
| CVE-2025-26340A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the a…Q-Free · MaxTime · CVSS 8.8 · 2025-02-12 | 8.8 | 1.2% | 2025-02-12 |
| CVE-2022-29829Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C,…Mitsubishi Electric Corporation · GX Works3 · CVSS 6.8 · 2022-11-24 | 6.8 | 1.2% | 2022-11-24 |
| CVE-2022-29828Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive in…Mitsubishi Electric Corporation · GX Works3 · CVSS 6.8 · 2022-11-24 | 6.8 | 1.2% | 2022-11-24 |
| CVE-2022-29827Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive in…Mitsubishi Electric Corporation · GX Works3 · CVSS 6.8 · 2022-11-24 | 6.8 | 1.2% | 2022-11-24 |
| CVE-2020-25180Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic KeyRockwell Automation · ISaGRAF Runtime · CVSS 5.3 · 2022-03-18 | 5.3 | 1.2% | 2022-03-18 |
| CVE-2019-19750minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.Minerstat · Msos · CVSS 9.8 · 2019-12-12 | 9.8 | 1.1% | 2019-12-12 |
| CVE-2020-28391A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants…Siemens · SCALANCE X-200 switch family (incl. SIPLUS NET variants) · 2021-01-12 | – | 1.1% | 2021-01-12 |
| CVE-2024-5296D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityD-Link · D-View · CVSS 9.8 · 2024-05-23 | 9.8 | 1.1% | 2024-05-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.