CVE-2025-30095: Use of Hard-coded Cryptographic Key

VyOS 1.3 through 1.5 fixed in 1.4.2 or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the...

CVE-2025-2516

The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...

CVE-2025-2516

The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...

CVE-2025-2516 Use of a weak cryptographic key in the signature verification process in WPS Office

The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...

CVE-2025-2516

CVE-2025-2516 affects Kingsoft WPS Office on Windows, where signature verification uses a weak cryptographic key pair. If the private key is recovered, an attacker could sign components. The issue is compounded by older WPS Office versions not validating the update server certificate, enabling a ...

CVE-2025-2516: Inadequate Encryption Strength

The use of a weak cryptographic key pair in the signature verification process in WPS Office Kingsoft on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the update server's certificate, an...

PT-2025-13240

Name of the Vulnerable Software and Affected Versions WPS Office Kingsoft versions affected versions not specified Description The issue involves the use of a weak cryptographic key pair in the signature verification process, allowing an attacker who successfully recovered the private key to sign...

CVE-2019-17659

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

CVE-2025-30234: Use of Hard-coded Cryptographic Key

SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image a Debian 12 LX zone image from 2024-07-26...

PT-2025-11659

Name of the Vulnerable Software and Affected Versions SmartOS version 60f76fd2-143f-4f57-819b-1ae32684e81b Description The issue concerns static host SSH keys in a specific Debian 12 LX zone image. This could potentially allow unauthorized access. The estimated number of affected devices is not...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

CVE-2019-17659

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

CVE-2024-54027

CVE-2024-54027 describes a Use of Hard-coded Cryptographic Key (CWE-321) in Fortinet FortiSandbox. Affected versions include 4.4.6 and below, 4.2.7 and below, 4.0.5 and below, 3.2.4 and below, 3.1.5 and below, and 3.0.7 to 3.0.5. A privileged attacker with a super-admin profile and CLI access can...

CVE-2024-54027: Use of Hard-coded Cryptographic Key

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

PT-2025-11478

Name of the Vulnerable Software and Affected Versions FortiSIEM version 5.2.6 Description A use of hard-coded cryptographic key issue may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user tunneluser by leveraging knowledge of the private key fro...

PT-2025-11053

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.6 and below FortiSandbox versions 4.2.7 and below FortiSandbox versions 4.0.5 and below FortiSandbox versions 3.2.4 and below FortiSandbox versions 3.1.5 and below FortiSandbox versions 3.0.5 through 3.0.7 Description...

CVE-2025-26849

There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules...