{"id":25264,"date":"2026-07-14T07:41:59","date_gmt":"2026-07-14T05:41:59","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=25264"},"modified":"2026-07-14T07:42:03","modified_gmt":"2026-07-14T05:42:03","slug":"usd-2025-36","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-36\/","title":{"rendered":"usd-2025-36"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.27.7\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.7\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2025-36 | Teamcenter 2312.8 - Hardcoded Secrets<\/h1>\n

<\/h1>\n

Product<\/strong>: Teamcenter
Affected Version<\/strong>: 2312.8
Vulnerability Type<\/strong>: Use of Hard-coded Credentials (CWE-798)
Security Risk<\/strong>: CRITICAL
Vendor<\/strong>: Siemens
Vendor URL<\/strong>: https:\/\/plm.sw.siemens.com\/de-DE\/teamcenter\/
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed<\/a>
CVE Number<\/strong>: CVE-2026-33893<\/a>
CVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-33893
Advisory ID<\/strong>: usd-2025-36<\/p>\n

Description<\/h3>\n

The application contains hardcoded secrets.<\/p>\n

Examples for these secrets are authentication information, tokens, or keys.
They are typically used to authenticate the application to services or to create and validate signatures.<\/p>\n

By storing the secrets inside the application itself, these could be revealed by an attacker disclosing the source code.
Furthermore, the use of hardcoded secrets increases the likelihood of them being reused in multiple environments, such as development and production.
This makes this information accessible to a larger number of people.<\/p>\n

This is particularly serious because the secrets cannot be easily changed due to being stored in an inflexible way.<\/p>\n

Proof of Concept<\/h3>\n

The Teamcenter FMS client cache (FCC) binary contains hardcoded secrets.
As the following output from the class PasswordTool<\/strong> shows, the function encrypt<\/strong> has two overloads, the first one taking the password and a secret key as parameters, the second one only taking the password.
In case the second overload is used, a hardcoded default key is utilized, which is also defined within the same class.<\/p>\n

Note that the following code is a result of decompilation and the actual line numbers may vary.<\/p>\n

Static key:<\/p>\n

\n
<\/span>public<\/span> <\/span>final<\/span> <\/span>class<\/span> PasswordTool<\/span> <\/span>{<\/span>\n    <\/span>private<\/span> <\/span>static<\/span> <\/span>final<\/span> <\/span>byte<\/span>[]<\/span> <\/span>DEFAULT_KEYBYTES<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>byte<\/span>[]<\/span>{<\/span>-<\/span>42<\/span>,<\/span> <\/span>26<\/span>,<\/span> <\/span>-<\/span>38<\/span>,<\/span> <\/span>69<\/span>,<\/span> <\/span>11<\/span>,<\/span> <\/span>120<\/span>,<\/span> <\/span>123<\/span>,<\/span> <\/span>50<\/span>,<\/span> <\/span>-<\/span>74<\/span>,<\/span> <\/span>-<\/span>70<\/span>,<\/span> <\/span>-<\/span>8<\/span>,<\/span> <\/span>77<\/span>,<\/span> <\/span>91<\/span>,<\/span> <\/span>64<\/span>,<\/span> <\/span>63<\/span>,<\/span> <\/span>59<\/span>};<\/span>\n<\/span>    <\/span>private<\/span> <\/span>static<\/span> <\/span>final<\/span> <\/span>SecretKey<\/span> <\/span>DEFAULT_KEY<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>SecretKeySpec<\/span>(<\/span>DEFAULT_KEYBYTES<\/span>,<\/span> <\/span>\"AES\"<\/span>);<\/span>\n<\/span><\/pre>\n<\/div>\n
First function overload:<\/p>\n
\n
<\/span>public<\/span> <\/span>static<\/span> <\/span>String<\/span> <\/span>encrypt<\/span>(<\/span>String<\/span> <\/span>password<\/span>,<\/span> <\/span>SecretKey<\/span> <\/span>key<\/span>)<\/span> <\/span>throws<\/span> <\/span>[<\/span>...<\/span>]<\/span> <\/span>{<\/span>\n    <\/span>try<\/span> <\/span>{<\/span>\n        <\/span>Base64<\/span> <\/span>base64coder<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>Base64<\/span>();<\/span>\n        <\/span>Cipher<\/span> <\/span>cipher<\/span> <\/span>=<\/span> <\/span>Cipher<\/span>.<\/span>getInstance<\/span>(<\/span>key<\/span>.<\/span>getAlgorithm<\/span>());<\/span>\n        <\/span>cipher<\/span>.<\/span>init<\/span>(<\/span>1<\/span>,<\/span> <\/span>key<\/span>);<\/span>\n        <\/span>return<\/span> <\/span>new<\/span> <\/span>String<\/span>(<\/span>base64coder<\/span>.<\/span>encode<\/span>(<\/span>cipher<\/span>.<\/span>doFinal<\/span>(<\/span>password<\/span>.<\/span>getBytes<\/span>(<\/span>\"UTF-8\"<\/span>))),<\/span> <\/span>\"UTF-8\"<\/span>);<\/span>\n    <\/span>}<\/span>\n    <\/span>catch<\/span> <\/span>(<\/span>UnsupportedEncodingException<\/span> <\/span>e<\/span>)<\/span> <\/span>{<\/span>\n        <\/span>e<\/span>.<\/span>printStackTrace<\/span>();<\/span>\n        <\/span>return<\/span> <\/span>null<\/span>;<\/span>\n    <\/span>}<\/span>\n}<\/span><\/pre>\n<\/div>\n
Second function overload:<\/p>\n
\n
<\/span>public<\/span> <\/span>static<\/span> <\/span>String<\/span> <\/span>encrypt<\/span>(<\/span>String<\/span> <\/span>password<\/span>)<\/span> <\/span>throws<\/span> <\/span>[<\/span>...<\/span>]<\/span> <\/span>{<\/span>\n    <\/span>return<\/span> <\/span>PasswordTool<\/span>.<\/span>encrypt<\/span>(<\/span>password<\/span>,<\/span> <\/span>DEFAULT_KEY<\/span>);<\/span>\n<\/span>}<\/span><\/pre>\n<\/div>\n
In practice, it appears that the application actually uses the insecure encryption routine with the default key, such as in the class PerformanceMeasurementHandler<\/strong>, which actually seems to write the encrypted password into a file.<\/p>\n
\n
<\/span>encryptedAuthCode<\/span> <\/span>=<\/span> <\/span>PasswordTool<\/span>.<\/span>encrypt<\/span>((<\/span>String<\/span>)<\/span>authString<\/span>);<\/span><\/pre>\n<\/div>\n
Fix<\/h3>\n
It is recommended to store secrets outside the source code in a strongly protected configuration file or database.
Different keys and tokens should be used for separate environments.<\/p>\n
References<\/h3>\n