Skip to main content

Weak Encoding for Password

CVE-2024-5434

Severity Medium
Score 6.9/10

Summary

The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwords within that file are stored in a weakly encoded format. There is no known way to remotely access the file unless it has been manually renamed. However, if an attacker were to gain access to the file, passwords could be decoded and reused to gain access.

  • LOW
  • ADJACENT
  • NONE
  • LOW

CWE-261 - Weak Encoding for Password

Obscuring a password with a trivial encoding does not protect the password.

References

Advisory Timeline

  • Published