Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-30206 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-2 (Baseline Configuration) and CM-6 (Configuration Settings) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10989
Vulnerability Data
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw…
more
allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the host machine, potentially leading to severe consequences such as sensitive data exposure, unauthorized command execution, privilege escalation, or further lateral movement within the network environment. This issue is patched in version 1.6.1. A workaround for this vulnerability involves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Requires establishing the most restrictive configuration settings, which directly overrides or prevents use of insecure default variable initializations.
Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.
Requires maintaining a documented baseline configuration that can enforce secure initial values instead of insecure defaults.
Requiring a documented development process and standards can mandate use of symbolic names for constants.
Mandates application of security engineering principles during development that include use of secure defaults and proper variable initialization.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management directly replace insecure product defaults with secure values.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect insecure defaults but does not prevent them.
Configuration management enforces secure default values and prevents insecure initialization.
Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.
Secure development life cycle requires explicit secure initialization of variables.
Secure architecture principles include avoiding insecure defaults in design.
Secure coding standards mandate explicit, safe variable initialization.