CWE · MITRE source
CWE-321Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key.
Last updated: 16 October 2026 07:24 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A04:2025 Cryptographic Failures.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
Prevent
Stop it (NIST 800-53 / CSF Protect)
Detect
Catch it (CSF Detect / Respond)
—
Harden
Shrink the surface (DISA STIG)
—
Validate
Prove the fix (OWASP ASVS)
—
NIST 800-53 r5 controls PROPOSED for this weakness (5)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SC-12 | Cryptographic Key Establishment and Management | SC | graded full Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries. |
SA-12 | Supply Chain Protection | SA | Supply chain protection includes scrutiny of cryptographic implementations, reducing hard-coded keys planted by untrusted vendors. |
SA-4 | Acquisition Process | SA | Functional and assurance requirements specified in acquisition can prohibit hard-coded cryptographic keys in delivered products. |
SC-17 | Public Key Infrastructure Certificates | SC | Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates. |
SR-6 | Supplier Assessments and Reviews | SR | Assessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2016-4437 KEV UPD | 9.9 | 9.8 | 0.9304 | 2016-06-07 |
CVE-2023-32169 UPD | 9.5 | 9.8 | 0.5606 | 2024-05-03 |
CVE-2023-27584 UPD | 8.9 | 9.8 | 0.3387 | 2024-09-19 |
CVE-2025-30406 KEV UPD | 8.9 | 9.0 | 0.9434 | 2025-04-03 |
CVE-2020-6990 UPD | 7.9 | 9.8 | 0.0437 | 2020-03-16 |
CVE-2020-10884 UPD | 7.9 | 8.8 | 0.2191 | 2020-03-25 |
CVE-2026-26335 UPD | 7.8 | 9.8 | 0.0290 | 2026-02-13 |
CVE-2026-74233 UPD | 7.8 | 9.8 | 0.0337 | 2026-08-27 |
CVE-2017-14021 UPD | 7.7 | 9.8 | 0.0192 | 2017-11-01 |
CVE-2016-9335 UPD | 7.7 | 10.0 | 0.0158 | 2018-05-09 |
CVE-2021-40119 UPD | 7.7 | 9.8 | 0.0250 | 2021-11-04 |
CVE-2025-57174 UPD | 7.7 | 9.8 | 0.0221 | 2025-09-15 |
CVE-2018-0040 UPD | 7.6 | 9.8 | 0.0143 | 2018-07-11 |
CVE-2022-0664 UPD | 7.6 | 9.8 | 0.0175 | 2022-02-18 |
CVE-2026-25894 | 7.6 | 9.8 | 0.0139 | 2026-02-09 |
CVE-2017-7574 UPD | 7.5 | 9.8 | 0.0125 | 2017-04-06 |
CVE-2019-19750 UPD | 7.5 | 9.8 | 0.0113 | 2019-12-12 |
CVE-2021-27389 UPD | 7.5 | 9.8 | 0.0103 | 2021-04-22 |
CVE-2021-32520 UPD | 7.5 | 9.8 | 0.0103 | 2021-07-07 |
CVE-2022-22987 UPD | 7.5 | 9.8 | 0.0121 | 2022-02-04 |
CVE-2023-27583 UPD | 7.5 | 9.8 | 0.0088 | 2023-03-13 |
CVE-2024-30207 UPD | 7.5 | 10.0 | 0.0084 | 2024-05-14 |
CVE-2024-5296 UPD | 7.5 | 9.8 | 0.0112 | 2024-05-23 |
CVE-2023-37936 UPD | 7.5 | 9.8 | 0.0099 | 2025-01-14 |
CVE-2025-30206 UPD | 7.5 | 9.8 | 0.0089 | 2025-04-15 |