Fallos del tipo CWE-326

208 resultados

Força de criptografia inadequada

A aplicação usa algoritmos ou tamanhos de chave criptográficos abaixo do padrão de segurança esperado para o contexto, deixando dados sensíveis vulneráveis a força bruta ou ataques criptanalíticos. Mesmo que o código implemente criptografia, uma chave pequena ou algoritmo fraco torna a proteção ineficaz.

Ejemplo

Um sistema bancário que salva senhas criptografadas com DES de 56 bits em vez de AES-256, ou que usa chaves RSA de 512 bits para certificados HTTPS. Um atacante com recursos moderados quebra essas chaves em horas ou dias.

Cómo mitigar

Use algoritmos modernos e reconhecidos (AES-256 para simétrico, RSA-2048+ ou curvas elípticas para assimétrico). Valide e atualize periodicamente o tamanho de chaves conforme recomendações de órgãos como NIST. Em Java/Python/.NET, prefira bibliotecas padrão (javax.crypto, cryptography, System.Security.Cryptography) e evite implementações caseiras.

CVE-2025-27524MEDIUMWeak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerEPSS 0.2%CVE-2024-29951MEDIUMBrocade SANnav has weak encryption in internal SSH portsEPSS 0.2%CVE-2026-4648MEDIUMInsufficient Encryption Level in CasfID Servicios Tecnológicos NFC WristbandsEPSS 0.2%CVE-2024-41681MEDIUMA vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configuredEPSS 0.2%CVE-2026-28377HIGHS3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)EPSS 0.2%CVE-2025-9513MEDIUMeditso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryptionEPSS 0.2%CVE-2025-2349LOWIROAD Dash Cam FX2 Password Hash passwd weak password hashEPSS 0.2%CVE-2022-21139HIGHInadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalEPSS 0.2%CVE-2024-37034MEDIUMAn issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with theEPSS 0.2%CVE-2018-19001—Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protectEPSS 0.2%CVE-2026-105996MEDIUMBooking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable TokenEPSS 0.2%CVE-2023-31135LOWDgraph Audit Log Encryption nonce reuseEPSS 0.2%CVE-2026-86824MEDIUMNewsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature KeyEPSS 0.2%CVE-2024-23580MEDIUMHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)EPSS 0.1%CVE-2024-23579MEDIUMHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questionsEPSS 0.1%CVE-2026-44523CRITICALNote Mark: JWT Secret Weakness allows Full Account Takeover via token forgeryEPSS 0.1%CVE-2025-45769MEDIUMphp-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to EPSS 0.1%CVE-2025-45770HIGHjwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be seEPSS 0.1%CVE-2025-43925MEDIUMAn issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the clearteEPSS 0.1%CVE-2026-82356HIGHImprivata EAM: Unrotatable X.509 RSA Key Pair in ProductionEPSS 0.1%