CWE-321 使用硬编码的密码学密钥 类弱点 380 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-321 指软件在代码中硬编码了不可更改的加密密钥。攻击者通过逆向工程提取该密钥，即可解密受保护数据或伪造合法通信，严重破坏机密性与完整性。开发者应避免此类做法，改用动态密钥管理机制，如从安全密钥库、环境变量或硬件安全模块中运行时获取密钥，确保密钥可轮换且不与源代码一同发布。
int VerifyAdmin(char *password) { if (strcmp(password,"68af404b513073584c4b6f22b6c63e6b")) { printf("Incorrect Password!\n"); return(0); } printf("Entering Diagnostic Mode...\n"); return(1); }public boolean VerifyAdmin(String password) { if (password.equals("68af404b513073584c4b6f22b6c63e6b")) { System.out.println("Entering Diagnostic Mode..."); return true; } System.out.println("Incorrect Password!"); return false;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-111347 | go-ldap-admin 0.6.2 硬编码RSA私钥漏洞 — go-ldap-admin | 5.9 | Medium | 2026-10-15 |
| CVE-2026-105035 | EnergizeLab FirmwareUpdater 硬编码AES密钥漏洞 — FirmwareUpdater | 7.8 | High | 2026-10-15 |
| CVE-2026-108336 | Token Signing Key 允许未认证的管理员访问 — Remot Ops Agent | 9.1 | Critical | 2026-10-14 |
| CVE-2026-100413 | SeaweedFS 硬编码 SSH 主机密钥漏洞 — seaweedfs | 7.0 | High | 2026-10-14 |
| CVE-2026-110612 | Vlife 2.0.1 JWT硬编码密钥认证绕过漏洞 — vlife | 9.8 | Critical | 2026-10-14 |
| CVE-2026-107171 | Trellix Agent 5.8.4硬编码密钥致数据库解密 — Trellix Agent | 6.9 | Medium | 2026-10-14 |
| CVE-2026-110214 | Snowy 3.6.5 硬编码下载签名密钥导致未授权文件下载漏洞 — Snowy | 3.7 | Low | 2026-10-13 |
| CVE-2026-106172 | FortiSandbox硬编码密钥致权限提升漏洞 — FortiSandbox | 4.9 | Medium | 2026-10-13 |
| CVE-2026-65198 | 华为设备默认SNMPv3 USM密钥漏洞 — openUBMC | 8.6 | High | 2026-10-13 |
| CVE-2026-109424 | 网易云音乐 eapi/xeapi 弱加密漏洞 — NetEase Cloud Music for Windows | 5.9 | Medium | 2026-10-12 |
| CVE-2026-108798 | ZKTeco BioTime 硬编码密钥漏洞 — BioTime | 7.3 | High | 2026-10-12 |
| CVE-2026-108860 | BotSharp 5.2.0 硬编码JWT密钥绕过认证漏洞 — BotSharp | 9.1 | Critical | 2026-10-11 |
| CVE-2026-87424 | Brocade ASCG<3.5.0认证绕过漏洞 — Brocade Active Support Connectivity Gateway | 8.6 | High | 2026-10-08 |
| CVE-2026-34499 | Johnson Controls ADVMS<3.10硬编码密钥泄露漏洞 — ADVMS | 8.5 | High | 2026-10-07 |
| CVE-2026-103778 | Dell Command Configure 5.2.3.35以下版本硬编码密钥漏洞 — Command | Configure (DCC) | 6.2 | Medium | 2026-10-06 |
| CVE-2026-85153 | Schmooze dating 移动应用信息泄露漏洞 — Schmooze dating mobile Application | 9.3 | Critical | 2026-10-06 |
| CVE-2026-105392 | Lyadmin JWT密钥硬编码漏洞 — Django-Vue-Lyadmin | 7.3 | High | 2026-10-05 |
| CVE-2026-94591 | Armatura One 使用硬编码加密密钥漏洞 — Armatura One | 8.4 | High | 2026-10-02 |
| CVE-2026-71449 | Johnson Controls EasyIO FS32 硬编码密钥漏洞 — EasyIO FS32 | 9.3 | Critical | 2026-10-01 |
| CVE-2026-82827 | JWT硬编码密钥导致管理功能滥用漏洞 — Hitachi Coding Software Suite | 9.8 | Critical | 2026-10-01 |
| CVE-2026-47097 | AJA HELO Plus 2.1.7前静态AES口令泄露漏洞 — HELO Plus | 7.5 | High | 2026-09-30 |
| CVE-2026-10764 | BVMS 4.5至12.3信息泄露漏洞 — BVMS | 8.7 | High | 2026-09-30 |
| CVE-2026-103055 | AiSOC 7.5.0至12.0.0 硬编码JWT密钥绕过认证漏洞 — AiSOC | 7.5 | High | 2026-09-30 |
| CVE-2026-102241 | Netcore NAP930 备份恢复硬编码密钥漏洞 — NAP930 | 2.7 | Low | 2026-09-29 |
| CVE-2026-82929 | mH-DEVELOPER 共享密钥使用漏洞 — mH-DEVELOPER | 6.3 | Medium | 2026-09-28 |
| CVE-2026-75553 | 日本东北电力“Yorisou e Net”应用硬编码密钥泄露 — Tohoku Electric Power "Yorisou e Net" Android App | 2.4 | Low | 2026-09-25 |
| CVE-2026-75558 | Botslab G980H 行车记录仪硬编码加密密钥漏洞 — G980H | 5.3 | Medium | 2026-09-24 |
| CVE-2026-79762 | Termix 硬编码密钥导致SSH凭据泄露 — Termix | 5.5 | Medium | 2026-09-24 |
| CVE-2026-18181 | IBM Financial Transaction Manager 多漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift | 8.1 | High | 2026-09-23 |
| CVE-2026-86708 | 敏感数据泄露漏洞 — ManageEngine Applications Manager | 10.0 | Critical | 2026-09-23 |
CWE-321（使用硬编码的密码学密钥） 是常见的弱点类别，本平台收录该类弱点关联的 380 条 CVE 漏洞。