Hard-coded Cryptographic Keys in Orion Visor Host Management

CVE-2026-90510 exposes a critical cryptographic flaw in dromara Orion Visor versions up to 2.5.7, where the HostKeyServiceImpl.encryptKey function uses hard-coded cryptographic keys instead of dynamically generated or properly managed credentials. This vulnerability (CWE-320: Key Management Errors, CWE-321: Use of Hard-coded Cryptographic Key) affects organizations deploying Orion Visor for asset and host key management. Since the vulnerability enables remote exploitation and publicly disclosed proof-of-concept code exists, any system running the affected versions faces immediate risk of unauthorized access to encrypted host credentials, potentially compromising entire infrastructure management capabilities.

While this CVE currently maps to zero MITRE ATT&CK techniques in public documentation, Casky's skill framework trained on Claude AI would detect the attack patterns and defensive gaps associated with this vulnerability. Practitioners using Casky would identify related skills covering credential access, lateral movement initiation points, and cryptographic weakness detection—specifically around T1110 (Brute Force) attacks against weak key spaces, T1555 (Credentials from Password Stores) exploitation, and T1021 (Remote Service Session Initiation) once credentials are compromised. Security teams querying Casky would surface findings related to improper cryptographic implementation assessment, hard-coded secret scanning in source code repositories, and runtime detection of symmetric encryption with static keys—enabling proactive remediation before attackers chain this vulnerability into broader compromise scenarios.