Advisories · Weakness

CWE-334.

Every Advisory and CVE whose sources give the weakness CWE-334, newest first.

CVE-2026-122118 CVE record

CVSS 7.4 High

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used.
- Yealink AVHub
- Yealink UVC86
- CWE-334
Not analysed yet 4 Nov 2026
crypto-js npm

CVSS 9.0 CriticalCritical · CVSS 9+

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- Weak cryptography or TLS
- CWE-331
<4.0.0 · fixed in 4.0.0

GHSA-rg76-677x-56q9 · CVE-2026-71851 Not analysed yet 7 Aug 2026
CVE-2024-54017 CVE record

CVSS 6.9 Medium

Siemens SIPROTEC 5 6MD84 (CP300): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0)…
- Siemens SIPROTEC 5 6MD84 (CP300)
- Siemens SIPROTEC 5 6MD85 (CP200)
- CWE-334
Not analysed yet 12 May 2026
CVE-2025-3895 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Low token entropy in MegaBIP
- Jan Syski MegaBIP
- CWE-334
Not analysed yet 23 May 2025
CVE-2024-52616 CVE record

CVSS 5.3 Medium

Avahi: avahi wide-area dns predictable transaction ids
- avahi
- Red Hat Enterprise Linux 9
- CWE-334
Not analysed yet 21 Nov 2024
sharks crates.io

CVSS 4.0, no score published

Sharks has a Bias of Polynomial Coefficients in Secret Sharing
- CWE-334
<=0.5.0 · no fixed version yet

GHSA-jp37-5qhw-mffw Not analysed yet 18 Nov 2024
CVE-2024-51720 CVE record

CVSS 4.8 Medium

Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
- BlackBerry SecuSUITE
- Authentication bypass
- CWE-334
Not analysed yet 12 Nov 2024
CVE-2024-6890 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Journyx Unauthenticated Password Reset Bruteforce
- Journyx (jtime)
- Hard-coded credentials
- CWE-334
Not analysed yet 7 Aug 2024
CVE-2023-6951 CVE record

CVSS 6.6 Medium

DJI Mavic 3 Pro: A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of…
- DJI Mavic 3 Pro
- DJI Mavic 3
- CWE-334
Not analysed yet 2 Apr 2024
CVE-2022-24402 CVE record

CVSS 8.8 High

Intentionally weakened effective strength in TETRA TEA1
- ETSI TETRA Standard
- CWE-334
Not analysed yet 19 Oct 2023
CVE-2023-39979 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

MXsecurity Authentication Bypass
- Moxa MXsecurity Series
- CWE-334
Not analysed yet 2 Sept 2023
CVE-2022-20941 CVE record

CVSS 5.3 Medium

Cisco Firepower Management Center: A vulnerability in the web-based management interface of Cisco Firepower Management…
- Cisco Firepower Management Center
- CWE-334
Not analysed yet 10 Nov 2022
CVE-2022-33707 CVE record

Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.
- Samsung Mobile FindMyMobile
- CWE-334
Not analysed yet 11 Jul 2022
CVE-2022-22517 CVE record

CVSS 7.5 High

Communication Components in multiple CODESYS products vulnerable to communication channel disruption
- CODESYS Control RTE (SL)
- CODESYS Control RTE (for Beckhoff CX) SL
- CWE-334
Not analysed yet 7 Apr 2022
CVE-2021-21955 CVE record

CVSS 7.7 High

Anker: An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid()…
- Anker
- CWE-334
Not analysed yet 9 Dec 2021
CVE-2020-7566 CVE record

CVSS 7.1 High

A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured t…
- Modicon M221, all references, all versions
- CWE-334
Not analysed yet 19 Nov 2020