787
System.out.println("Entering Diagnostic Mode...");
return true;
}
System.out.println("Incorrect Password!");
return false;
Example Language: C# (Bad)
int VerifyAdmin(String password) {
if (password.Equals("68af404b513073584c4b6f22b6c63e6b")) {
Console.WriteLine("Entering Diagnostic Mode...");
return(1);
}
Console.WriteLine("Incorrect Password!");
return(0);
}
The cryptographic key is within a hard-coded string value that is compared to the password. It is
likely that an attacker will be able to read the key and compromise the system.
Example 2:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors used hard-coded keys for critical functionality in their OT products.
Observed Examples
Reference Description
CVE-2022-29960 Engineering Workstation uses hard-coded cryptographic keys that could allow
for unathorized filesystem access and privilege escalation
https://www.cve.org/CVERecord?id=CVE-2022-29960
CVE-2022-30271 Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely
to be used by default.
https://www.cve.org/CVERecord?id=CVE-2022-30271
CVE-2020-10884 WiFi router service has a hard-coded encryption key, allowing root access
https://www.cve.org/CVERecord?id=CVE-2020-10884
CVE-2014-2198 Communications / collaboration product has a hardcoded SSH private key,
allowing access to root account
https://www.cve.org/CVERecord?id=CVE-2014-2198
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 719 OWASP Top Ten 2007 Category A8 - Insecure
Cryptographic Storage
629 2333
MemberOf 720 OWASP Top Ten 2007 Category A9 - Insecure
Communications
629 2333
MemberOf 729 OWASP Top Ten 2004 Category A8 - Insecure Storage 711 2338
MemberOf 950 SFP Secondary Cluster: Hardcoded Sensitive Data 888 2396
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
CWE Version 4.14
CWE-322: Key Exchange without Entity Authentication
CWE-322: Key Exchange without Entity Authentication