Reliance on Security Through Obscurity
CWE-656
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Architecture and Design: Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.
- Architecture and Design: When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.
- Architecture and Design: Obscurity can be one small part of defense in depth, since it can create more work for an attacker; however, it is a significant risk if used as the primary means of protection.
Latest Reliance on Security Through Obscurity vulnerabilities
- 9.3 Critical severity
GV-IP Device Utility: Reliance on Security Through Obscurity
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulner
- 9.3 Critical severity
GV-IP Device Utility: Reliance on Security Through Obscurity
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulner
- 8.5 High severity
Kaba exos 9300: Reliance on Security Through Obscurity
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from th
- 9.2 Critical severity
EDS-508A Series: Reliance on Security Through Obscurity
Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implementation. Th
- 7.2 High severity
EDR-810 Series: Reliance on Security Through Obscurity
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level