CWE-261
AllowedWeak Encoding for Password
Abstraction: Base · Status: Incomplete
Obscuring a password with a trivial encoding does not protect the password.
72 vulnerabilities reference this CWE, most recent first.
GHSA-WGCP-RFQ6-33JH
Vulnerability from github – Published: 2026-06-09 21:32 – Updated: 2026-06-09 21:32Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.
{
"affected": [],
"aliases": [
"CVE-2026-40639"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T19:17:53Z",
"severity": "MODERATE"
},
"details": "Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-wgcp-rfq6-33jh",
"modified": "2026-06-09T21:32:36Z",
"published": "2026-06-09T21:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40639"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000453482/dsa-2026-197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQ7C-6J9M-M824
Vulnerability from github – Published: 2026-02-10 12:30 – Updated: 2026-02-10 12:30A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. This could allow an attacker to recover the original passwords and might gain unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2024-52334"
],
"database_specific": {
"cwe_ids": [
"CWE-261"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T10:15:55Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in syngo.plaza VB30E (All versions \u003c VB30E_HF07). The affected application does not encrypt the passwords properly.\nThis could allow an attacker to recover the original passwords and might gain unauthorized access.",
"id": "GHSA-xq7c-6j9m-m824",
"modified": "2026-02-10T12:30:26Z",
"published": "2026-02-10T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52334"
},
{
"type": "WEB",
"url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-016040"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Passwords should be encrypted with keys that are at least 128 bits in length for adequate security.
CAPEC-55: Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.