Fallos del tipo CWE-1391

53 resultados

Uso de credenciais fracas

Ocorre quando uma aplicação aceita, permite ou armazena credenciais (senhas, tokens, chaves) que não possuem força criptográfica ou complexidade suficiente. Isso facilita ataques de força bruta, dicionário ou até adivinhação, comprometendo a autenticação do sistema.

Ejemplo

Uma API que permite login com senhas de 3 caracteres, ou um serviço que gera tokens de acesso com apenas 4 dígitos numéricos. Um atacante consegue testar todas as combinações possíveis em segundos e ganhar acesso não autorizado.

Cómo mitigar

Implemente políticas obrigatórias de senha (mínimo 12 caracteres, complexidade, sem padrões óbvios) e use algoritmos criptográficos fortes para gerar tokens (ex: pelo menos 256 bits de entropia). Valide a força das credenciais tanto no servidor quanto na interface de criação.

CVE-2024-51978CRITICALAuthentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.EPSS 24.4%CVE-2025-53558HIGHZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, anEPSS 1.4%CVE-2024-40892HIGHFirewalla BTLE Weak CredentialsEPSS 0.9%CVE-2024-12728CRITICALA weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3)EPSS 0.9%CVE-2024-43659HIGHPlaintext default credentials in firmwareEPSS 0.8%CVE-2025-6077CRITICALCVE-2025-6077EPSS 0.7%CVE-2024-11717MEDIUMTokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sentEPSS 0.7%CVE-2024-45272HIGHMB connect line/Helmholz: Generation of weak passwords vulnerabilityEPSS 0.6%CVE-2026-35089HIGHUse of Weak Credentials in Slican telephone exchangesEPSS 0.6%CVE-2022-3010HIGHPredictable SSH credentials in Priva TopControl SuiteEPSS 0.6%CVE-2024-42027MEDIUMThe E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they havEPSS 0.5%CVE-2023-48257HIGHThe vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) witEPSS 0.5%CVE-2026-39920CRITICALBridgeHead FileStore < 24A Apache Axis2 Default Credentials RCEEPSS 0.5%CVE-2023-31240HIGHSnap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC EPSS 0.5%CVE-2025-67114CRITICALUse of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware befEPSS 0.5%CVE-2025-52364HIGHInsecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initiEPSS 0.5%CVE-2024-7558HIGHJUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unpriEPSS 0.5%CVE-2024-45722HIGHRuijie Reyee OS Use of Weak CredentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.5%CVE-2025-35970HIGHOn multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information availEPSS 0.4%