CWE-321 describes the use of a hard-coded cryptographic key: a secret embedded directly in software or firmware instead of being generated, stored, and managed securely. If the key is exposed, every device or installation that shares it may become vulnerable at once. This weakness matters because cryptographic protection is only as strong as the secrecy of the key. When the same embedded secret is reused across products, an attacker who extracts it from one copy can often reuse it against others.
In real attacks, CWE-321 can weaken encrypted management traffic, local discovery channels, or authentication workflows, especially on IoT devices and appliances. A local attacker, a reverse engineer, or malware with access to the firmware may be able to recover the key and then impersonate trusted components or decrypt protected data. Defenders reduce the risk by generating unique keys per device, storing secrets in secure hardware or protected keystores, rotating credentials, and designing systems so that one leaked secret does not expose an entire product line.