CWE-326
Allowed-with-ReviewInadequate Encryption Strength
Abstraction: Class · Status: Draft
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
654 vulnerabilities reference this CWE, most recent first.
GHSA-HJ85-PMJM-XQX2
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980.
{
"affected": [],
"aliases": [
"CVE-2021-38862"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-12T19:15:00Z",
"severity": "HIGH"
},
"details": "IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207980.",
"id": "GHSA-hj85-pmjm-xqx2",
"modified": "2022-05-24T19:17:16Z",
"published": "2022-05-24T19:17:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38862"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/207980"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6497499"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HJVF-VWPV-9G29
Vulnerability from github – Published: 2023-11-16 09:30 – Updated: 2023-12-01 21:30Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.
{
"affected": [],
"aliases": [
"CVE-2023-43757"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-16T07:15:08Z",
"severity": "MODERATE"
},
"details": "Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication. As for the affected products/versions, see the information provided by the vendor under [References] section.",
"id": "GHSA-hjvf-vwpv-9g29",
"modified": "2023-12-01T21:30:26Z",
"published": "2023-11-16T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43757"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU94119876"
},
{
"type": "WEB",
"url": "https://www.elecom.co.jp/news/security/20210706-01"
},
{
"type": "WEB",
"url": "https://www.elecom.co.jp/news/security/20230810-01"
},
{
"type": "WEB",
"url": "https://www.elecom.co.jp/news/security/20231114-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HM9H-QVFM-GGW4
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2023-01-30 21:30IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.
{
"affected": [],
"aliases": [
"CVE-2019-4151"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-25T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.",
"id": "GHSA-hm9h-qvfm-ggw4",
"modified": "2023-01-30T21:30:40Z",
"published": "2022-05-24T16:48:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4151"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158512"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/docview.wss?uid=ibm10888379"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HP45-3W87-63C3
Vulnerability from github – Published: 2025-07-31 21:31 – Updated: 2025-07-31 21:31jwt v5.4.3 was discovered to contain weak encryption.
{
"affected": [],
"aliases": [
"CVE-2025-45770"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T20:15:33Z",
"severity": "HIGH"
},
"details": "jwt v5.4.3 was discovered to contain weak encryption.",
"id": "GHSA-hp45-3w87-63c3",
"modified": "2025-07-31T21:31:53Z",
"published": "2025-07-31T21:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45770"
},
{
"type": "WEB",
"url": "https://gist.github.com/ZupeiNie/cd88c827eef11a1618f8baacccd240fb"
},
{
"type": "WEB",
"url": "https://github.com/lcobucci"
},
{
"type": "WEB",
"url": "https://github.com/lcobucci/jwt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HP9J-R2QW-J3VW
Vulnerability from github – Published: 2022-12-19 12:30 – Updated: 2022-12-23 18:30In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
{
"affected": [],
"aliases": [
"CVE-2022-38659"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T11:15:00Z",
"severity": "HIGH"
},
"details": "In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.",
"id": "GHSA-hp9j-r2qw-j3vw",
"modified": "2022-12-23T18:30:40Z",
"published": "2022-12-19T12:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38659"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0102049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPFR-FH2J-J4M2
Vulnerability from github – Published: 2023-08-28 12:30 – Updated: 2024-04-04 07:14An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book.
{
"affected": [],
"aliases": [
"CVE-2022-46783"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-28T12:15:08Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book.",
"id": "GHSA-hpfr-fh2j-j4m2",
"modified": "2024-04-04T07:14:03Z",
"published": "2023-08-28T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46783"
},
{
"type": "WEB",
"url": "https://advisories.stormshield.eu"
},
{
"type": "WEB",
"url": "https://advisories.stormshield.eu/2022-029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQHM-W88M-83J6
Vulnerability from github – Published: 2022-05-14 03:20 – Updated: 2022-05-14 03:20IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704.
{
"affected": [],
"aliases": [
"CVE-2014-0841"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-27T16:29:00Z",
"severity": "MODERATE"
},
"details": "IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. IBM X-Force ID: 90704.",
"id": "GHSA-hqhm-w88m-83j6",
"modified": "2022-05-14T03:20:02Z",
"published": "2022-05-14T03:20:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0841"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90704"
},
{
"type": "WEB",
"url": "https://www.ibm.com/blogs/psirt/ibm-security-bulletin-weak-password-hash-vulnerability-in-rational-focalpoint-cve-2014-0841"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HQHQ-PXHF-F4JJ
Vulnerability from github – Published: 2022-05-17 02:50 – Updated: 2022-05-17 02:50OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.
{
"affected": [],
"aliases": [
"CVE-2016-5056"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-10T03:59:00Z",
"severity": "HIGH"
},
"details": "OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.",
"id": "GHSA-hqhq-pxhf-f4jj",
"modified": "2022-05-17T02:50:12Z",
"published": "2022-05-17T02:50:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5056"
},
{
"type": "WEB",
"url": "https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HV4Q-F4H2-QJ89
Vulnerability from github – Published: 2022-02-11 00:00 – Updated: 2022-02-18 00:00A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)
{
"affected": [],
"aliases": [
"CVE-2022-24318"
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-09T23:15:00Z",
"severity": "HIGH"
},
"details": "A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)",
"id": "GHSA-hv4q-f4h2-qj89",
"modified": "2022-02-18T00:00:58Z",
"published": "2022-02-11T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24318"
},
{
"type": "WEB",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HV9M-498V-FP67
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2025-05-22 21:30Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.
{
"affected": [],
"aliases": [
"CVE-2019-13539"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-328"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-08T20:15:00Z",
"severity": "HIGH"
},
"details": "Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.",
"id": "GHSA-hv9m-498v-fp67",
"modified": "2025-05-22T21:30:31Z",
"published": "2022-05-24T22:01:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13539"
},
{
"type": "WEB",
"url": "https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-02"
},
{
"type": "WEB",
"url": "https://www.us-cert.gov/ics/advisories/icsma-19-311-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Use an encryption scheme that is currently considered to be strong by experts in the field.
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-192: Protocol Analysis
An adversary engages in activities to decipher and/or decode protocol information for a network or application communication protocol used for transmitting information between interconnected nodes or systems on a packet-switched data network. While this type of analysis involves the analysis of a networking protocol inherently, it does not require the presence of an actual or physical network.
CAPEC-20: Encryption Brute Forcing
An attacker, armed with the cipher text and the encryption algorithm used, performs an exhaustive (brute force) search on the key space to determine the key that decrypts the cipher text to obtain the plaintext.