The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.
GX Earth 2022 ONT models contain a hardcoded RSA private key within their device firmware. This cryptographic vulnerability allows a remote attacker to extract the private key, potentially enabling decryption of HTTPS traffic and facilitating Man-in-the-Middle (MITM) attacks against the device. The vulnerability is identified as CWE-321 and has a high severity score of 8.7. No patch or official remediation guidance is currently available from the vendor.
Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.
NVIDIA DGX OS has a vulnerability in its factory provisioning process where cloning a base image results in identical SSH host keys being deployed across multiple systems. This reuse of cryptographic identifiers allows potential host impersonation or man-in-the-middle attacks. Exploiting this vulnerability could lead to code execution, data tampering, privilege escalation, information disclosure, and denial of service. The vulnerability is tracked as CVE-2026-24218 with a high severity score of 8.1. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.
Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Certain firmware versions of the Milesight MS-Cxx63-PD AIOT cameras use SSL certificates that rely on default private keys. This vulnerability, identified as CWE-321, exposes the devices to potential compromise of encrypted communications. The CVSS 4.0 score of 9.2 indicates a critical severity due to network attack vector, low attack complexity, and no required privileges or user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
A vulnerability was determined in Datavane Datavines up to 13607645e14a4982468cfdbcf75c85cde63bae71. The affected element is an unknown function of the file datavines-core/src/main/java/io/datavines/core/utils/TokenManager.java of the component JWT Token Handler. Executing a manipulation of the argument tokenSecret can lead to use of hard-coded cryptographic key
. The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This patch is called e540d6dc04e2e6ad11907fb655f3728a13e7b939. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through a pull request but has not reacted yet.
Anviz CX7 Firmware is
vulnerable because the application embeds reusable certificate/key
material, enabling decryption of MQTT traffic and potential interaction
with device messaging channels at scale.
Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.
The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.
This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVE-2025-15605 is a high-severity vulnerability in TP-Link Archer NX series routers, including NX200, NX210, NX500, and NX600 v3.0, caused by a hardcoded cryptographic key used in the device configuration mechanism. An authenticated attacker with low privileges can decrypt, modify, and re-encrypt configuration files, compromising the confidentiality and integrity of device settings. Exploitation does not require user interaction but does require authentication. No known exploits are currently in the wild. This vulnerability affects the security posture of impacted devices by enabling unauthorized configuration changes, potentially leading to network compromise or persistent backdoors. Organizations using these devices should prioritize mitigation steps such as firmware updates, restricting access to management interfaces, and monitoring configuration changes. Countries with significant TP-Link market penetration and strategic reliance on these devices are at higher risk. The CVSS v4.0 score is 8.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.
Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confidentiality protections.