CWE-5
AllowedJ2EE Misconfiguration: Data Transmission Without Encryption
Abstraction: Variant · Status: Draft
Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
2 vulnerabilities reference this CWE, most recent first.
GHSA-5C5P-G26H-XX2F
Vulnerability from github – Published: 2026-01-10 12:30 – Updated: 2026-01-12 21:30J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.
Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0.
Users are recommended to upgrade to version 1.9.0, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2025-52435"
],
"database_specific": {
"cwe_ids": [
"CWE-5"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-10T10:15:50Z",
"severity": "HIGH"
},
"details": "J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE.\n\nImproper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.\nThis issue affects Apache NimBLE: through \u003c= 1.8.0.\n\nUsers are recommended to upgrade to version 1.9.0, which fixes the issue.",
"id": "GHSA-5c5p-g26h-xx2f",
"modified": "2026-01-12T21:30:34Z",
"published": "2026-01-10T12:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52435"
},
{
"type": "WEB",
"url": "https://github.com/apache/mynewt-nimble/commit/164f1c23c18a290908df76ed83fe848bfe4a4903"
},
{
"type": "WEB",
"url": "https://github.com/apache/mynewt-nimble/commit/ec3d75e909fa6dcadf1836fefc4432794a673d18"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ow8dzpsqfh9llfclh5fzh6z237brzc0s"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QR6V-4WJJ-WX5H
Vulnerability from github – Published: 2025-12-11 00:30 – Updated: 2025-12-11 18:30Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.
{
"affected": [],
"aliases": [
"CVE-2025-65297"
],
"database_specific": {
"cwe_ids": [
"CWE-5"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-10T22:16:27Z",
"severity": "HIGH"
},
"details": "Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.",
"id": "GHSA-qr6v-4wjj-wx5h",
"modified": "2025-12-11T18:30:43Z",
"published": "2025-12-11T00:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65297"
},
{
"type": "WEB",
"url": "https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
The product configuration should ensure that SSL or an encryption mechanism of equivalent strength and vetted reputation is used for all access-controlled pages.
No CAPEC attack patterns related to this CWE.