CWE-321 vulnerabilities

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVE-2026-10764 is a vulnerability in IQSIGHT BVMS versions 4.5 through 12.3 that involves the use of a hard-coded cryptographic key. This flaw allows man-in-the-middle attackers to gain unauthorized access to sensitive information, resulting in information disclosure. The vulnerability has a high severity rating with a CVSS score of 8.7.

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception. This issue was fixed in version 3.0.30

The Botslab G980H dash camera firmware contains a vulnerability due to the use of a hard-coded cryptographic key and initialization vector to protect WiFi credentials. This weakness allows an attacker who extracts the cryptographic material from the firmware to recover the WiFi password and potentially gain unauthorized access to the device's network. The issue affects specific firmware versions =30010_QHG980HN5294SysFW+ and =58_QHG980HMCN5291SysFW+. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6. No patch or remediation information is currently provided.

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

ZohoCorp ManageEngine Applications Manager versions prior to 182300 contain a hard-coded Google Cloud service-account private key in the installer. This vulnerability allows unauthenticated attackers to impersonate the service account and potentially access or modify associated cloud resources. The vulnerability is identified as CWE-321 and has a critical CVSS score of 10. A patch is available to remediate this issue.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

A vulnerability in lxc-ci's Arch Linux images prior to 2026-05-28 involves the use of a hard-coded pacman local-signing private key. This key is embedded in the image and distributed to all containers or virtual machines created from it. An attacker who can control or intercept HTTP package mirror traffic can misuse this key to sign malicious packages, which affected clients will trust and install. Successful exploitation allows arbitrary code execution with root privileges on the client system. The issue is fixed in Arch Linux images published on or after 2026-05-28.

SolarWinds Access Rights Manager contains a vulnerability due to the use of a hard-coded cryptographic key. This flaw allows unauthenticated remote code execution, posing a high risk to confidentiality, integrity, and availability of the affected system.

Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.3 contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow an unauthenticated remote attacker to gain unauthorized access. The vulnerability is identified as CWE-321 and has a high severity rating with a CVSS score of 8.1. A fix is available in version 11.1.0.3.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 for the appliance and prior to 5.36.00.00 for the application contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow an unauthenticated attacker with remote access to potentially gain unauthorized access. The vulnerability is identified as CWE-321 and has a medium severity rating with a CVSS score of 4.4.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.