CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
21 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-0323 — FTP uses unsecure encryption mechanisms
- CVE-2025-24802 — Soundness issue with Plonky2 look up tables
- CVE-2025-62514 — `libparsec_crypto` does not check for weak order point of curve 25519
- CVE-2024-0220 — B&R products use insufficient communication encryption
- CVE-2026-46654 — Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
- CVE-2025-46424 — Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerabilit
- CVE-2026-22705 — RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
- CVE-2026-21751 — HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- CVE-2025-64647 — Multiple Vulnerabilities in IBM Concert Software
- CVE-2025-14505 — Elliptic Cryptanalysis vulnerability when `k` has leading zeros
- CVE-2025-29779 — Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`
- CVE-2025-68833 — HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- CVE-2024-37137 — Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnera
- CVE-2025-22475 — Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primiti
- CVE-2026-44410 — Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE
- CVE-2025-53960 — Apache StreamPark: Uses the user’s password as the secret key
Recently published
- CVE-2025-68833 — HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- CVE-2026-21751 — HCL Hive is affected by use of a cryptographic primitive with a risky implementation
- CVE-2026-46654 — Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
- CVE-2026-44410 — Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE
- CVE-2025-64647 — Multiple Vulnerabilities in IBM Concert Software
- CVE-2025-62514 — `libparsec_crypto` does not check for weak order point of curve 25519
- CVE-2026-22705 — RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
- CVE-2025-14505 — Elliptic Cryptanalysis vulnerability when `k` has leading zeros
- CVE-2025-53960 — Apache StreamPark: Uses the user’s password as the secret key
- CVE-2025-46424 — Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerabilit
- CVE-2025-29779 — Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`
- CVE-2025-22475 — Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primiti
- CVE-2025-24802 — Soundness issue with Plonky2 look up tables
- CVE-2024-37137 — Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnera
- CVE-2024-0220 — B&R products use insufficient communication encryption
- CVE-2024-0323 — FTP uses unsecure encryption mechanisms
More specific weaknesses
- CWE-325 — Missing Cryptographic Step