cve.bz

CWE-326: Inadequate Encryption Strength, page 4

Filter

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

What the weakness is: CWE-326 at MITRE. OWASP Top 10: A04:2025 Cryptographic Failures

Related attack patterns (CAPEC): 3
  • CAPEC-20 Encryption Brute Forcing Likelihood: Low · Severity: Low
  • CAPEC-112 Brute Force Severity: High
  • CAPEC-192 Protocol Analysis Likelihood: Low · Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-326, as MITRE names them. Credits.

Ask an AI about CWE-326

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-326: Inadequate Encryption Strength and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/326.html and https://cve.bz/cve/cwe/326?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-47366EPSS 0.4%

    The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  2. 6.5CVE-2023-47365EPSS 0.4%

    The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  3. 6.5CVE-2023-47364EPSS 0.4%

    The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims

  4. 6.5CVE-2023-47363EPSS 0.4%

    The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.

  5. 7.5CVE-2022-48193EPSS 0.3%

    Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).

  6. 7.5CVE-2023-44690EPSS 0.3%

    Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py

  7. 7.8CVE-2023-30132EPSS 0.2%

    An issue discovered in IXP Data EasyInstall 6.6.14907.0 allows attackers to gain escalated privileges via static Cryptographic Key.

  8. 6.6CVE-2023-43776EPSS 0.1%

    Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program …

  9. 7.5CVE-2023-4129EPSS 0.2%

    Dell Data Protection Central, version 19.9, contains an Inadequate Encryption Strength Vulnerability. An unauthenticated network attacker could potentially exploit this vulnerability, allowing an attacker to recover plaintext from a block …

  10. 7.5CVE-2023-41305EPSS 0.5%

    Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality.

  11. 5.3CVE-2022-46783EPSS 0.3%

    An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book.

  12. 8.8CVE-2023-34971EPSS 0.1%

    An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors…

  13. 5.5CVE-2023-4333EPSS 0.1%

    Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

  14. 7.5CVE-2023-0525EPSS 0.7%

    Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 model versions 01.49.000 and prior, GT23 model versions 01.49.000 and prior, GT21 model versions 01.49…

  15. 7.5CVE-2023-28021EPSS 0.3%

    The BigFix WebUI uses weak cipher suites.

  16. 7.8CVE-2023-21145EPSS 0.09%

    In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n…

  17. 5.5CVE-2023-20942EPSS 0.07%

    In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execut…

  18. 7.4CVE-2023-20185EPSS 0.3%

    A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerabi…

  19. 6.8CVE-2023-35332EPSS 0.5%

    Windows Remote Desktop Protocol Security Feature Bypass

  20. 6.8CVE-2023-36748EPSS 0.2%

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM …

  21. 8.8CVE-2023-34337EPSS 0.2%

    AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integr…

  22. 5.3CVE-2023-37301EPSS 0.3%

    An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.

  23. 7.5CVE-2023-36539EPSS 0.5%

    Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.

  24. 9.8CVE-2023-3243EPSS 0.6%Unsupported when assigned

    [An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack. Impacted product is BCM-WEB version 3.3.X. Re…

  25. 8.6CVE-2023-32414EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.4. An app may be able to break out of its sandbox.

  26. 5.5CVE-2023-33283EPSS 0.1%

    Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.

  27. 6.5CVE-2023-29549EPSS 0.3%

    Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Fire…

  28. 6.5CVE-2023-23597EPSS 0.3%

    A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `file://` context. Given a reliable exploit primitive, this new process could be exploited again leadi…

  29. 5.9CVE-2023-33982EPSS 0.5%

    Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic between two accounts if they later compromise both accounts. NOTE: the eavesdropping is typically impractical because B…

  30. 7.5CVE-2022-45453EPSS 0.3%

    TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.

  31. 5.5CVE-2023-31135EPSS 0.2%

    Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The l…

  32. 6.5CVE-2023-1764EPSS 0.2%

    Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup …

  33. 7.8CVE-2023-21109EPSS 0.1%

    In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…

  34. 7.7CVE-2022-4048EPSS 0.08%

    Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.

  35. 7.5CVE-2023-2443EPSS 0.7%

    Rockwell Automation ThinManager product allows the use of medium strength ciphers.  If the client requests an insecure cipher, a malicious actor could potentially decrypt traffic sent between the client and server API.

  36. 7.5CVE-2023-30351EPSS 0.2%

    Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UA…

  37. 2.5CVE-2023-2197EPSS 0.09%

    HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and resta…

  38. 5.5CVE-2023-28124EPSS 0.08%

    Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI Desktop configuration files to decrypt their content.This vulnerability is fixed in Version 0.62.3 and lat…

  39. 6.5CVE-2023-24502EPSS 0.2%

    Electra Central AC unit – The unit opens an AP with an easily calculated password.

  40. 7.4CVE-2023-29054EPSS 0.3%

    A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-…

  41. 7.2CVE-2023-27389EPSS 0.5%

    Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial…

  42. 9.1CVE-2023-27987EPSS 0.8%

    In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend us…

  43. 5.3CVE-2023-22271EPSS 0.8%

    Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password…

  44. 7.5CVE-2023-23911EPSS 0.3%

    An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.

  45. 9.8CVE-2022-45141EPSS 0.5%

    Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tick…

  46. 5.5CVE-2022-34385EPSS 0.1%

    SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtai…

  47. 8.8CVE-2023-21444EPSS 0.2%

    Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commands.

  48. 8.8CVE-2023-21443EPSS 0.2%

    Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted messages or inject commands.

  49. 6.5CVE-2022-43922EPSS 0.4%

    IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak hash of an API Key in the configuration. IBM X-Force ID: 241583.

  50. 5.5CVE-2021-40341EPSS 0.09%

    DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue…