Gladinet CentreStack / Triofox < 16.12.10420.56791 Hardcoded Credentials

According to its banner, the version of Gladinet CentreStack / Triofox running on the remote host is prior to 16.12.10420.56791. It is, therefore, affected by an arbitrary local file inclusion due to the CentreStack / Triofox portal's use hardcoded values for their implementation of the AES...

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially...

CVE-2025-14611

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted...

CVE-2025-52268: Exposure of Sensitive Information to an Unauthorized Actor

StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens...

EUVD-2015-4106

Malware in sbrugna...

EUVD-2018-17564

Malware in sbrugna...

CVE-2025-57174

An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys hardcoded in the binary. These keys are identical across all...

CVE-2024-25731

The Elink Smart eSmartCam com.cn.dq.ipc application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data e.g., over Wi-Fi...

CVE-2020-27181

A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files...

CVE-2023-20512

CVE-2023-20512 describes a hardcoded AES key in PMFW that could allow a privileged attacker to access the key and potentially leak internal debug information. Multiple connected sources corroborate PMFW as the affected component and the root cause as a hardcoded key, leading to unauthorized acces...

CVE-2024-25731

The Elink Smart eSmartCam com.cn.dq.ipc application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data e.g., over Wi-Fi...

CVE-2023-21426

The CVE-2023-21426 vulnerability affects Samsung mobile devices running SMR prior to Jan-2023 Release 1, where a hardcoded AES key is used to encrypt card emulation PINs in NFC. The root cause is the hardcoded key in the NFC card emulation workflow, enabling local attackers to access cardemulatio...

PT-2020-16652

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue concerns a hardcoded AES key in the Java applet of the affected software. This hardcoded key allows attackers to craft password-reset tokens or decrypt server-side...

Cellebrite EPR Decryption Hardcoded AES Key Material Vulnerability

The Cellebrite UFED Physical device relies on key material hardcoded within both the executable code supporting the decryption process and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of...

Cellebrite EPR Decryption Hardcoded AES Key Material

KL-001-2020-003 : Cellebrite EPR Decryption Relies on Hardcoded AES Key Material Title: Cellebrite EPR Decryption Relies on Hardcoded AES Key Material Advisory ID: KL-001-2020-003 Publication Date: 2020.06.29 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt 1...

CVE-2018-5797: Use of Hard-coded Credentials

An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is an Smintencrypt Hardcoded AES Key that can be used for packet decryption obtaining cleartext credentials by an attacker who has access to a wired port...

PT-2018-17154

Name of the Vulnerable Software and Affected Versions: Extreme Networks ExtremeWireless WiNG versions 5.x before 5.8.6.9 Extreme Networks ExtremeWireless WiNG versions 5.9.x before 5.9.1.3 Description: An issue was discovered that involves an Smint encrypt hardcoded AES key. This key can be used ...

CVE-2017-15582

In net.MCrypt in the "Diary with lock" aka WriteDiary application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries...

CVE-2014-4875

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...

CVE-2014-4875

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server BOSS DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access...