Falhas do tipo CWE-326

208 resultados

Criptografia com força inadequada

Ocorre quando um desenvolvedor implementa criptografia, mas usa algoritmos, tamanhos de chave ou modos de operação insuficientes para proteger dados sensíveis contra força bruta ou criptoanálise. Um exemplo clássico é usar DES em vez de AES, ou chaves RSA de 512 bits quando o padrão mínimo aceitável é 2048 bits.

Exemplo

Uma aplicação que armazena senhas usando MD5 ou SHA-1 sem salt, ou que criptografa dados de cartão de crédito com AES-128 quando deveria ser AES-256. Um atacante consegue quebrar essas chaves com recursos computacionais modernos em tempo viável.

Como mitigar

Use algoritmos criptográficos modernos e fortes: AES-256 para simetria, RSA-2048 (ou superiores) para assimetria, bcrypt/Argon2 para hashing de senhas, e sempre com salt ou IV aleatório. Siga as recomendações de órgãos como NIST ou BSI para tamanhos mínimos de chave.

CVE-2025-27524MEDIUMWeak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device ManagerEPSS 0.2%CVE-2024-29951MEDIUMBrocade SANnav has weak encryption in internal SSH portsEPSS 0.2%CVE-2026-4648MEDIUMInsufficient Encryption Level in CasfID Servicios Tecnológicos NFC WristbandsEPSS 0.2%CVE-2024-41681MEDIUMA vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configuredEPSS 0.2%CVE-2026-28377HIGHS3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern)EPSS 0.2%CVE-2025-9513MEDIUMeditso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryptionEPSS 0.2%CVE-2022-21139HIGHInadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalEPSS 0.2%CVE-2025-2349LOWIROAD Dash Cam FX2 Password Hash passwd weak password hashEPSS 0.2%CVE-2024-37034MEDIUMAn issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with theEPSS 0.2%CVE-2018-19001—Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protectEPSS 0.2%CVE-2026-105996MEDIUMBooking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable TokenEPSS 0.2%CVE-2023-31135LOWDgraph Audit Log Encryption nonce reuseEPSS 0.2%CVE-2026-86824MEDIUMNewsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature KeyEPSS 0.2%CVE-2024-23579MEDIUMHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questionsEPSS 0.1%CVE-2024-23580MEDIUMHCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)EPSS 0.1%CVE-2026-44523CRITICALNote Mark: JWT Secret Weakness allows Full Account Takeover via token forgeryEPSS 0.1%CVE-2025-45769MEDIUMphp-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to EPSS 0.1%CVE-2025-45770HIGHjwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be seEPSS 0.1%CVE-2025-43925MEDIUMAn issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the clearteEPSS 0.1%CVE-2014-2381—Schneider Electric Wonderware Inadequate Encryption StrengthEPSS 0.1%