Threats Tagged 'cwe-321'

SAP BusinessObjects Business Intelligence Platform (Central Management Server) contains a vulnerability where sensitive credentials are stored using a hard-coded cryptographic key. An attacker with high privileges and local access could decrypt these credentials, compromising confidentiality and integrity. There is no impact on availability.

A vulnerability in TP-Link Systems Inc. HB810(US2) devices (versions V1.0, 1.6, 2.0, and 2.6) involves the use of hardcoded cryptographic keys embedded in the firmware. This flaw allows attackers with access to device storage to recover these keys and decrypt sensitive configuration data, including credentials and service-related information. The vulnerability has a high severity score of 8.5 and does not currently have an official patch or remediation guidance.

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524.

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.