CWEweakness
CWE-261 Weak Encoding for Password
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product uses a weak or trivial encoding for a password.
Common consequences
• Access Control: Gain Privileges or Assume Identity
Potential mitigations
• Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2022-45099: network attached storage (NAS) product uses weak encoding for a password
Related
Attack pattern · CAPEC (1)
- CAPEC-55 Rainbow Table Password Cracking attack pattern
Observed example · CVE (1)
- CVE-2022-45099 Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. vulnerability
Child of · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
Referenced by CAPEC · weakness (1)
- CAPEC-55 Rainbow Table Password Cracking attack pattern
Referenced by CVE · weakness (44)
- CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to… vulnerability
- CVE-2026-73589 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for… vulnerability
- CVE-2026-63424 During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local… vulnerability
- CVE-2026-67596 CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to… vulnerability
- CVE-2026-40639 Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. vulnerability
- CVE-2026-25607 Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords… vulnerability
- CVE-2025-11500 Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication mechanisms - one solely for… vulnerability
- CVE-2026-0809 Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be… vulnerability
- CVE-2024-52334 A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). vulnerability
- CVE-2025-67652 An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain… vulnerability
- CVE-2026-22543 The credentials required to access the device's web server are sent in base64 within the HTTP headers. vulnerability
- CVE-2025-25298 Strapi is an open source headless CMS. vulnerability
- CVE-2025-11155 The credentials required to access the device's web server are sent in base64 within the HTTP headers. vulnerability
- CVE-2025-31229 A logic issue was addressed with improved checks. vulnerability
- CVE-2025-26401 Weak encoding for password vulnerability exists in HMI ViewJet C-more series. vulnerability
- CVE-2024-7407 Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded… vulnerability
- CVE-2025-2862 SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. vulnerability
- CVE-2024-45273 An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of… vulnerability
- CVE-2024-8455 The swctrl service is used to detect and remotely manage PLANET Technology devices. vulnerability
- CVE-2024-34542 Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process. vulnerability
- CVE-2024-37187 Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. vulnerability
- CVE-2024-45394 Authenticator is a browser extension that generates two-step verification codes. vulnerability
- CVE-2024-34113 ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a… vulnerability
- CVE-2024-5434 The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. vulnerability
- CVE-2024-24279 An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated… vulnerability
- CVE-2024-28270 An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to… vulnerability
- CVE-2024-23492 A weak encoding is used to transmit credentials for WS203VICM. vulnerability
- CVE-2023-7237 Lantronix XPort sends weakly encoded credentials within web request headers. vulnerability
- CVE-2024-0556 A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. vulnerability
- CVE-2023-28896 Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via… vulnerability