Weaknesses of type CWE-326

196 results

Força criptográfica inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográfica insuficientes para proteger dados sensíveis contra ataques conhecidos. Por exemplo, usar DES, MD5 ou chaves RSA de 512 bits fornece proteção que pode ser quebrada em tempo viável com poder computacional moderno, deixando dados expostos.

Example

Um sistema de autenticação que armazena senhas hasheadas com MD5, ou uma API que criptografa dados com DES em vez de AES-256. Um atacante com acesso aos hashes consegue recuperar as senhas por força bruta, ou quebra a criptografia DES em horas.

How to mitigate

Use algoritmos reconhecidos como seguro (AES-256 para cifra simétrica, RSA 2048+ ou ECDSA para assimétrica, bcrypt/scrypt/argon2 para senhas). Revise regularmente o padrão criptográfico da sua stack — o que era seguro em 2015 pode estar comprometido hoje.

CVE-2025-22446MEDIUMInadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to poteEPSS 0.1%CVE-2021-40341HIGHWeak DES encryptionEPSS 0.1%CVE-2025-32874HIGHAn issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class beEPSS 0.1%CVE-2022-4048HIGHCODESYS V3 prone to Inadequate Encryption StregthEPSS 0.1%CVE-2024-13454MEDIUMWeak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when EPSS 0.1%CVE-2023-28124MEDIUMImproper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI DesktopEPSS 0.1%CVE-2023-37397LOWIBM Aspera Faspex data manipulationEPSS 0.1%CVE-2025-48960MEDIUMWeak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build EPSS 0.1%CVE-2026-41860HIGHCWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_asEPSS 0.1%CVE-2024-21787HIGHInadequate encryption strength for some BMRA software before version 22.08 may allow an authenticated user to potentially enable escalation EPSS 0.1%CVE-2023-6728LOWNokia SR OS: BOF File Encryption VulnerabilityEPSS 0.1%CVE-2023-20942—In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a EPSS 0.1%CVE-2025-41743MEDIUMSprecher Automation: SPRECON-E series prone to weak encryption of update filesEPSS 0.1%CVE-2026-14868HIGHWeak encryption mechanism for User directoryEPSS 0.1%CVE-2025-45764LOWjsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs cEPSS 0.1%CVE-2026-82356HIGHImprivata EAM: Unrotatable X.509 RSA Key Pair in ProductionEPSS —