# CWE-656.

Every Advisory and CVE whose sources give the weakness CWE-656, newest first.

## Records, newest first

- [TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)](https://agentprime.io/advisories/PKSA-rwzb-f3sr-qs44.md)
  `PKSA-rwzb-f3sr-qs44`, `CVE-2026-112067` · Packagist `blueways/bw-captcha`: affected `>=4.0.0, <5.4.2`, fixed in `5.4.2` · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-656, CWE-804
- [GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability](https://agentprime.io/advisories/CVE-2026-7161.md)
  `CVE-2026-7161` · CVE record: GeoVision Inc. GV-IP Device Utility · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: CWE-656
- [GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability](https://agentprime.io/advisories/CVE-2026-42363.md)
  `CVE-2026-42363` · CVE record: GeoVision Inc. GV-IP Device Utility · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2026 · Tags: CWE-656
- [Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59093.md)
  `CVE-2025-59093` · CVE record: dormakaba Kaba exos 9300 · CVSS 8.5 High · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-656
- [BYD DiLink OS Incorrect encryption Implementation of system log dumps](https://agentprime.io/advisories/CVE-2025-7020.md)
  `CVE-2025-7020` · CVE record: BYD DiLink OS · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: CWE-656
- [An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based shari…](https://agentprime.io/advisories/CVE-2025-25983.md)
  `CVE-2025-25983` · CVE record · CVSS 3.4 Low · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-257, CWE-656
- [Frontend Authorization Logic Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-12297.md)
  `CVE-2024-12297` · CVE record: Moxa EDS-508A Series and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-656
- [Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances](https://agentprime.io/advisories/CVE-2024-9138.md)
  `CVE-2024-9138` · CVE record: Moxa EDR-810 Series and 4 more · CVSS 8.6 High · Not analysed yet · Published 3 Jan 2025 · Tags: CWE-656
- [TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability](https://agentprime.io/advisories/CVE-2024-5244.md)
  `CVE-2024-5244` · CVE record: TP-Link Omada ER605 · CVSS 5.0 Medium · Not analysed yet · Published 23 May 2024 · Tags: CWE-656
- [RVD#3323: Mismanaged permission implementation leads to privilege escalation, exfiltration of sensitive information, and DoS](https://agentprime.io/advisories/CVE-2020-10286.md)
  `CVE-2020-10286` · CVE record: uFactory xArm 5 Lite, xArm 6 and xArm 7 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2020 · Tags: CWE-656
- [RVD#3321: No Authentication required to exert manual control of the robot](https://agentprime.io/advisories/CVE-2020-10284.md)
  `CVE-2020-10284` · CVE record: uFactory xArm5 Lite, xArm 6 and xArm 7 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2020 · Tags: CWE-656
- [RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation](https://agentprime.io/advisories/CVE-2020-10277.md)
  `CVE-2020-10277` · CVE record: Mobile Industrial Robots A/S MiR100 · CVSS 6.4 Medium · Not analysed yet · Published 24 Jun 2020 · Tags: CWE-656

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-656>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-656/>. Everything for agents: <https://agentprime.io/llms.txt>.