Falhas do tipo CWE-326

195 resultados

Criptografia com força inadequada

Ocorre quando um desenvolvedor implementa criptografia, mas usa algoritmos, tamanhos de chave ou modos de operação insuficientes para proteger dados sensíveis contra força bruta ou criptoanálise. Um exemplo clássico é usar DES em vez de AES, ou chaves RSA de 512 bits quando o padrão mínimo aceitável é 2048 bits.

Exemplo

Uma aplicação que armazena senhas usando MD5 ou SHA-1 sem salt, ou que criptografa dados de cartão de crédito com AES-128 quando deveria ser AES-256. Um atacante consegue quebrar essas chaves com recursos computacionais modernos em tempo viável.

Como mitigar

Use algoritmos criptográficos modernos e fortes: AES-256 para simetria, RSA-2048 (ou superiores) para assimetria, bcrypt/Argon2 para hashing de senhas, e sempre com salt ou IV aleatório. Siga as recomendações de órgãos como NIST ou BSI para tamanhos mínimos de chave.

CVE-2025-22446MEDIUMInadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to poteEPSS 0.1%CVE-2021-40341HIGHWeak DES encryptionEPSS 0.1%CVE-2025-32874HIGHAn issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0. A vulnerability exists in the EncryptionUtil class beEPSS 0.1%CVE-2022-4048HIGHCODESYS V3 prone to Inadequate Encryption StregthEPSS 0.1%CVE-2024-13454MEDIUMWeak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when EPSS 0.1%CVE-2023-28124MEDIUMImproper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI DesktopEPSS 0.1%CVE-2023-37397LOWIBM Aspera Faspex data manipulationEPSS 0.1%CVE-2025-48960MEDIUMWeak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build EPSS 0.1%CVE-2024-21787HIGHInadequate encryption strength for some BMRA software before version 22.08 may allow an authenticated user to potentially enable escalation EPSS 0.1%CVE-2026-41860HIGHCWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_asEPSS 0.1%CVE-2023-6728LOWNokia SR OS: BOF File Encryption VulnerabilityEPSS 0.1%CVE-2023-20942—In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a EPSS 0.1%CVE-2025-41743MEDIUMSprecher Automation: SPRECON-E series prone to weak encryption of update filesEPSS 0.1%CVE-2026-14868HIGHWeak encryption mechanism for User directoryEPSS 0.1%CVE-2025-45764LOWjsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs cEPSS 0.1%