CWE-916 Use of Password Hash With Insufficient Computational Effort
baseThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (162)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-10618US | critical9.8 | Exploit | ||
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the… | ||||
| CVE-2005-0408US | critical9.8 | Exploit | ||
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileg… | ||||
| CVE-2023-33243US | high8.1 | Exploit | ||
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext passwo… | ||||
| CVE-2024-3183US | high8.1 | Exploit | ||
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it fro… | ||||
| CVE-2018-9233US | high7.8 | Exploit | ||
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers t… | ||||
| CVE-2021-38314US | medium5.3 | Exploit | ||
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `re… | ||||
| CVE-2020-14516US | critical10.0 | — | ||
In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm with FactoryTalk Servi… | ||||
| CVE-2014-2560US | high7.5 | Exploit | ||
The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a… | ||||
| CVE-2019-6563US | critical9.8 | — | ||
Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of t… | ||||
| CVE-2026-30789US | critical9.8 | — | ||
Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-cli… | ||||
| CVE-2025-3937US | critical9.8 | — | ||
Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux… | ||||
| CVE-2023-5846US | critical9.8 | — | ||
Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to the device.
| ||||
| CVE-2023-34433US | critical9.8 | — | ||
PiiGAB M-Bus stores passwords using a weak hash algorithm.
| ||||
| CVE-2022-37164US | critical9.8 | — | ||
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user pass… | ||||
| CVE-2022-37163US | critical9.8 | — | ||
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally,… | ||||
| CVE-2021-36767US | critical9.8 | — | ||
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker… | ||||
| CVE-2019-17216US | critical9.8 | — | ||
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with min… | ||||
| CVE-2018-15681US | critical9.8 | — | ||
An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged… | ||||
| CVE-2018-15680US | critical9.8 | — | ||
An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent… | ||||
| CVE-2017-3962US | critical9.8 | — | ||
Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan