CWE-656: Reliance on Security Through Obscurity
Filter
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
What the weakness is: CWE-656 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Ask an AI about CWE-656
Show the prompt
Explain CWE-656: Reliance on Security Through Obscurity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/656.html and https://cve.bz/cve/cwe/656?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-112067EPSS 0.4%
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies…
- 9.3CVE-2026-7161EPSS 0.2%
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages t…
- 9.3CVE-2026-42363EPSS 0.2%
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages t…
- 8.5CVE-2025-59093EPSS 0.2%
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read …
- 5.1CVE-2025-7020EPSS 0.2%
An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g. in the model ATTO3). An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-V…
- 3.4CVE-2025-25983EPSS 0.3%
An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component.
- 9.2CVE-2024-12297EPSS 0.8%
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in i…
- 8.6CVE-2024-9138EPSS 1.1%
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privilege…
- 4.2CVE-2024-5244EPSS 0.4%
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not…
- 8.8CVE-2020-10286EPSS 0.7%
the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that dis…
- 9.1CVE-2020-10284EPSS 1.4%
No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the men…
- 6.4CVE-2020-10277EPSS 0.4%
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on th…