CWEweakness
CWE-353 Missing Support for Integrity Check
Medium
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Likelihood of exploit
- Medium
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
Extended description
The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.
Common consequences
• Non-Repudiation, Integrity, Other: Other, Hide Activities — If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission, i.e., it is impossible to determine if any changes have been made to the data after it was sent. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. Data that is parsed and used may be corrupted.
Potential mitigations
• [Architecture and Design] Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
• [Implementation] Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.
Observed examples
• CVE-2025-32890: Mesh device uses a cryptographic algorithm without integrity checking, allowing modification of messages
Related
Attack pattern · CAPEC (7)
- CAPEC-13 Subverting Environment Variable Values attack pattern
- CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
- CAPEC-389 Content Spoofing Via Application API Manipulation attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
- CAPEC-74 Manipulating State attack pattern
- CAPEC-75 Manipulating Writeable Configuration Files attack pattern
Observed example · CVE (1)
- CVE-2025-32890 An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. vulnerability
Child of · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
Peer of · CWE (1)
- CWE-354 Improper Validation of Integrity Check Value weakness
Referenced by CAPEC · weakness (7)
- CAPEC-13 Subverting Environment Variable Values attack pattern
- CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
- CAPEC-389 Content Spoofing Via Application API Manipulation attack pattern
- CAPEC-39 Manipulating Opaque Client-based Data Tokens attack pattern
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws attack pattern
- CAPEC-74 Manipulating State attack pattern
- CAPEC-75 Manipulating Writeable Configuration Files attack pattern
Referenced by CVE · weakness (52)
- CVE-2026-77157 ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its… vulnerability
- CVE-2026-76751 A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. vulnerability
- CVE-2026-79801 A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an… vulnerability
- CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. vulnerability
- CVE-2026-76853 Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix… vulnerability
- CVE-2026-84533 A cryptographic issue was addressed with improved integrity checks. vulnerability
- CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. vulnerability
- CVE-2026-81049 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. vulnerability
- CVE-2026-58224 A flaw was found in Samba's CTDB, the clustered database service used by Samba. vulnerability
- CVE-2026-17583 The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. vulnerability
- CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. vulnerability
- CVE-2026-12705 Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). vulnerability
- CVE-2026-48995 pnpm is a package manager. vulnerability
- CVE-2026-7574 Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and… vulnerability
- CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. vulnerability
- CVE-2026-42428 OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. vulnerability
- CVE-2026-33261 A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service. vulnerability
- CVE-2026-3856 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism… vulnerability
- CVE-2025-10010 The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to… vulnerability
- CVE-2025-15364 The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including,… vulnerability
- CVE-2026-21437 eopkg is a Solus package manager implemented in python3. vulnerability
- CVE-2025-65203 KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP… vulnerability
- CVE-2024-46917 Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity… vulnerability
- CVE-2025-48500 A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker… vulnerability
- CVE-2025-48803 Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate… vulnerability
- CVE-2025-48811 Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate… vulnerability
- CVE-2025-32882 An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. vulnerability
- CVE-2025-32890 An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. vulnerability
- CVE-2024-43108 The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. vulnerability
- CVE-2024-47123 The goTenna Pro App uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. vulnerability
Referenced by CWE · has member (2)
Referenced by CWE · peer of (1)
- CWE-354 Improper Validation of Integrity Check Value weakness