CWE-326
Allowed-with-ReviewInadequate Encryption Strength
Abstraction: Class · Status: Draft
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
664 vulnerabilities reference this CWE, most recent first.
GHSA-MX5Q-V692-HX4M
Vulnerability from github – Published: 2021-12-31 00:00 – Updated: 2022-07-13 00:01Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with full control of the device.
{
"affected": [],
"aliases": [
"CVE-2021-20161"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-30T22:15:00Z",
"severity": "HIGH"
},
"details": "Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with full control of the device.",
"id": "GHSA-mx5q-v692-hx4m",
"modified": "2022-07-13T00:01:04Z",
"published": "2021-12-31T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20161"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2021-54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MXFC-HGC2-6WXG
Vulnerability from github – Published: 2023-05-16 00:30 – Updated: 2024-04-04 04:11In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261589597
{
"affected": [],
"aliases": [
"CVE-2023-21109"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-15T22:15:11Z",
"severity": "HIGH"
},
"details": "In multiple places of AccessibilityService, there is a possible way to hide the app from the user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261589597",
"id": "GHSA-mxfc-hgc2-6wxg",
"modified": "2024-04-04T04:11:30Z",
"published": "2023-05-16T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21109"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-05-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P383-F595-X4QW
Vulnerability from github – Published: 2022-10-11 12:00 – Updated: 2022-10-11 19:00The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-3433"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-328",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-10T22:15:00Z",
"severity": "MODERATE"
},
"details": "The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.",
"id": "GHSA-p383-f595-x4qw",
"modified": "2022-10-11T19:00:25Z",
"published": "2022-10-11T12:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3433"
},
{
"type": "WEB",
"url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P38X-2CFM-G52F
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-07-13 00:01Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
{
"affected": [],
"aliases": [
"CVE-2021-28213"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T16:15:00Z",
"severity": "HIGH"
},
"details": "Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.",
"id": "GHSA-p38x-2cfm-g52f",
"modified": "2022-07-13T00:01:14Z",
"published": "2022-05-24T19:05:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28213"
},
{
"type": "WEB",
"url": "https://bugzilla.tianocore.org/show_bug.cgi?id=1866"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P3H7-3C45-QJ4V
Vulnerability from github – Published: 2022-05-17 05:18 – Updated: 2024-09-27 17:28Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.1"
},
"package": {
"ecosystem": "PyPI",
"name": "keyring"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-4571"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-29T21:40:04Z",
"nvd_published_at": "2012-11-30T22:55:00Z",
"severity": "HIGH"
},
"details": "Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for `CryptedFileKeyring` files, which makes it easier for local users to obtain passwords via a brute-force attack.",
"id": "GHSA-p3h7-3c45-qj4v",
"modified": "2024-09-27T17:28:09Z",
"published": "2022-05-17T05:18:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4571"
},
{
"type": "WEB",
"url": "https://github.com/jaraco/keyring/commit/162f2ed0e39e16d561732b9fad8af6cd2341d7bd"
},
{
"type": "WEB",
"url": "https://github.com/jaraco/keyring/commit/56272d908ba7a3fe4ebb6d6e87a7cc569f4726ac"
},
{
"type": "WEB",
"url": "https://github.com/jaraco/keyring/commit/a76942672f6ac85a88bd9b9ed31fd133119b7702"
},
{
"type": "WEB",
"url": "https://github.com/jaraco/keyring/commit/cbf509b0386c3063d8b2879ce72d78ac18023f72"
},
{
"type": "WEB",
"url": "https://github.com/jaraco/keyring/commit/cc1ead78d1e3fab9fa8bb0b4bb334cb82d35db52"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/python-keyring/+bug/1004845"
},
{
"type": "PACKAGE",
"url": "https://github.com/jaraco/keyring"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keyring/PYSEC-2012-8.yaml"
},
{
"type": "WEB",
"url": "http://pypi.python.org/pypi/keyring"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/10/31/8"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1634-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:P",
"type": "CVSS_V4"
}
],
"summary": "Python Keyring does not securely initialize encryption cipher"
}
GHSA-P5J8-HCX4-456V
Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2026-02-24 18:30The fingerprint module has a security risk of brute force cracking. Successful exploitation of this vulnerability may affect data confidentiality.
{
"affected": [],
"aliases": [
"CVE-2021-40006"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-10T14:10:00Z",
"severity": "MODERATE"
},
"details": "The fingerprint module has a security risk of brute force cracking. Successful exploitation of this vulnerability may affect data confidentiality.",
"id": "GHSA-p5j8-hcx4-456v",
"modified": "2026-02-24T18:30:55Z",
"published": "2022-01-11T00:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40006"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/8"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202112-0000001183296718"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P5MP-XG3R-JXWF
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage.
{
"affected": [],
"aliases": [
"CVE-2019-7648"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-08T17:29:00Z",
"severity": "HIGH"
},
"details": "controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage.",
"id": "GHSA-p5mp-xg3r-jxwf",
"modified": "2022-05-13T01:22:52Z",
"published": "2022-05-13T01:22:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7648"
},
{
"type": "WEB",
"url": "https://github.com/FantasticLBP/Hotels_Server/issues/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P5X3-568X-9FQ9
Vulnerability from github – Published: 2022-05-14 01:22 – Updated: 2022-05-14 01:22Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
{
"affected": [],
"aliases": [
"CVE-2018-5184"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-11T21:29:00Z",
"severity": "HIGH"
},
"details": "Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR \u003c 52.8 and Thunderbird \u003c 52.8.",
"id": "GHSA-p5x3-568x-9fq9",
"modified": "2022-05-14T01:22:00Z",
"published": "2022-05-14T01:22:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5184"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1725"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1726"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1411592"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201811-13"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3660-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4209"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2018-13"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104240"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040946"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P723-W3QM-QPVW
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access.
{
"affected": [],
"aliases": [
"CVE-2020-8761"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-12T18:15:00Z",
"severity": "MODERATE"
},
"details": "Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access.",
"id": "GHSA-p723-w3qm-qpvw",
"modified": "2022-05-24T17:34:14Z",
"published": "2022-05-24T17:34:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8761"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20201113-0002"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PC4M-VCWH-9C5H
Vulnerability from github – Published: 2022-11-01 19:00 – Updated: 2022-11-03 19:00The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
{
"affected": [],
"aliases": [
"CVE-2020-4099"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T18:15:00Z",
"severity": "HIGH"
},
"details": "The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.",
"id": "GHSA-pc4m-vcwh-9c5h",
"modified": "2022-11-03T19:00:25Z",
"published": "2022-11-01T19:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4099"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0100861"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use an encryption scheme that is currently considered to be strong by experts in the field.
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-192: Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
CAPEC-20: Encryption Brute Forcing
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.