33 matches found
CVE-2023-43261
CVE-2023-43261 - PoC Critical Vulnerability Exposes Sensitive Information and Enables Unauthorized Access in Milesight Routers Date: 1 October 2023 Vendor of the product: Milesight Formerly Xiamen Ursalink Technology Co., Ltd. Affected Products: UR5X, UR32L, UR32, UR35, UR41 and there might be...
CVE-2026-112345
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...
EUVD-2026-109945
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...
CVE-2026-112345
The T틀ock Android application (prior to version v9.8.260718 ) and its associated smart-lock firmware are vulnerable to a hardcoded static AES key issue (CWE-321). An attacker within Bluetooth range can observe the BLE pairing exchange and use the embedded defaultKey to decrypt the per-pairing ses...
PT-2026-116095
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...
Number Sea Wen Zhou Visual Drag-and-Drop Big Data Integration Platform Backend Encryption Vulnerability
The backend commit efeacd3 and previous versions of the visual drag-and-drop big data integration platform have vulnerabilities related to encryption. This vulnerability stems from the use of a hardcoded public default AES key in the AesPasswordEncAndDecServiceImpl component. This allows...
EnergizeLab FirmwareUpdater has a cryptographic vulnerability
EnergizeLab FirmwareUpdater has a cryptographic vulnerability. This vulnerability stems from the use of a single hardcoded AES key shared across all installations. Attackers can retrieve this key from the update program, thereby decrypting and forging the firmware package...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
EUVD-2026-56117
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
CVE-2026-57262
The CVE-2026-57262 vulnerability affects LOGO! Soft Comfort (All versions
CVE-2026-57262
A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...
PT-2026-70187
Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V9 Description Products use a static, hardcoded AES master key to encrypt project files. A local attacker could extract this master key from the application files or memory to decrypt project files or remov...
CVE-2026-35019
NetComm NF20MESH routers with firmware R6B031 and earlier are affected by an authentication bypass in the web management interface. The root cause is a hardcoded AES-256 key used to encrypt session cookies; an attacker can forge a valid encrypted cookie with the shared key to bypass authenticatio...
EUVD-2026-38453
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can for...
MAXHUB Pivot client application encryption issue vulnerability
The MAXHUB Pivot client application is a client component of the MAXHUB company’s device management platform. Versions of the MAXHUB Pivot client application prior to 1.36.2 contained an encryption vulnerability. This vulnerability stemmed from the hardcoded AES key within the application. It cou...
CVE-2026-6411: Use of a Broken or Risky Cryptographic Algorithm
This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata from any tenant. Due to the presence of a hardcoded AES key within the application, the encrypted data can be decrypted,...
CVE-2025-52268: Exposure of Sensitive Information to an Unauthorized Actor
StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...
