CWE-757
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Monthly
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
TLS protocol downgrade in IBM i 7.3 through 7.6 enables remote attackers to force negotiation of TLS versions explicitly disabled in the server configuration, undermining the operator's security posture by exposing session traffic to potential decryption. The CVSS vector (AV:N/AC:H/PR:N) confirms this is network-exploitable without authentication but requires high attack complexity, consistent with a man-in-the-middle positioning requirement during the TLS handshake. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; a vendor patch is available per IBM advisory 7278992.
wolfSSL's TLS 1.2 handshake logic silently downgrades Encrypt-then-MAC (ETM) to MAC-then-Encrypt when a client presents a stale session ID during a failed resumption attempt, affecting all builds compiled with HAVE_ENCRYPT_THEN_MAC using CBC-mode cipher suites. This ETM extension silent-disable (CWE-757) exposes the downgraded connection to CBC-mode side-channel attacks such as Lucky Thirteen, exploitable by an adjacent-network attacker. No public exploit identified at time of analysis and no confirmed active exploitation; vendor patch is available upstream via PR #10167.
Zephyr RTOS sockets created with IPPROTO_TLS_1_3 can negotiate TLS 1.2 connections when both TLS versions are enabled in Kconfig, because socket-level protocol selection is not propagated to mbedTLS's minimum version enforcement. Applications explicitly requesting TLS 1.3 may silently fall back to TLS 1.2, exposing them to known TLS 1.2 weaknesses such as POODLE or truncation attacks. Remote unauthenticated attackers can exploit this via network-level protocol downgrade during the TLS handshake.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
Anviz CrossChex Standard time and attendance software transmits database credentials in plaintext when attackers downgrade TDS7 PreLogin protocol encryption, enabling remote unauthenticated access to backend databases containing employee data and access control records. CVSS 7.5 (High) with network attack vector and no prerequisites. Reported by CISA ICS-CERT, indicating industrial/physical security context. EPSS and KEV status not provided in available data.
OpenSSL and Microsoft products using the 'DEFAULT' keyword in TLS 1.3 key exchange group configurations may negotiate weaker cryptographic groups than intended, allowing network-based attackers to potentially downgrade the security of encrypted connections without authentication or user interaction. This affects servers that combine default group lists with custom configurations, particularly impacting hybrid post-quantum key exchange implementations where clients defer group selection. A patch is available to remediate this high-severity confidentiality risk.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Silent OAuth 1.0a-to-1.0 protocol downgrade in the Perl module Net::OAuth::Client (versions before 0.32) lets a service provider strip the anti-session-fixation protection an application explicitly requested. When an app configures a callback (selecting 1.0a) but the provider's request-token response omits oauth_callback_confirmed, get_request_token silently reverts to OAuth 1.0, which drops the oauth_verifier from the access-token exchange with no exception or warning, re-exposing the app to OAuth session fixation. No public exploit identified at time of analysis; EPSS is low (0.21%) and this is not in CISA KEV, but the fix is vendor-confirmed in release 0.32.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by the client, bypassing certificate validation and enabling full traffic decryption and manipulation. This affects OTP versions 17.0 through prior to 27.3.4.15, 28.5.0.4, and 29.0.4. The vulnerability is resolved in patched releases; no active exploitation or public proof-of-concept is known at this time.
TLS protocol downgrade in IBM i 7.3 through 7.6 enables remote attackers to force negotiation of TLS versions explicitly disabled in the server configuration, undermining the operator's security posture by exposing session traffic to potential decryption. The CVSS vector (AV:N/AC:H/PR:N) confirms this is network-exploitable without authentication but requires high attack complexity, consistent with a man-in-the-middle positioning requirement during the TLS handshake. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; a vendor patch is available per IBM advisory 7278992.
wolfSSL's TLS 1.2 handshake logic silently downgrades Encrypt-then-MAC (ETM) to MAC-then-Encrypt when a client presents a stale session ID during a failed resumption attempt, affecting all builds compiled with HAVE_ENCRYPT_THEN_MAC using CBC-mode cipher suites. This ETM extension silent-disable (CWE-757) exposes the downgraded connection to CBC-mode side-channel attacks such as Lucky Thirteen, exploitable by an adjacent-network attacker. No public exploit identified at time of analysis and no confirmed active exploitation; vendor patch is available upstream via PR #10167.
Zephyr RTOS sockets created with IPPROTO_TLS_1_3 can negotiate TLS 1.2 connections when both TLS versions are enabled in Kconfig, because socket-level protocol selection is not propagated to mbedTLS's minimum version enforcement. Applications explicitly requesting TLS 1.3 may silently fall back to TLS 1.2, exposing them to known TLS 1.2 weaknesses such as POODLE or truncation attacks. Remote unauthenticated attackers can exploit this via network-level protocol downgrade during the TLS handshake.
Cryptographic algorithm downgrade in AWS Encryption SDK for Python's caching layer allows authenticated local attackers to bypass key commitment policy enforcement through a shared key cache, enabling decryption of single ciphertext to multiple different plaintexts. Affected versions include Python 2 up to 2.5.1, Python 3 up to 3.3.0, and Python 4 up to 4.0.4. AWS has released vendor patches (versions 3.3.1, 4.0.5, and later) to remediate the vulnerability, which requires local access and authenticated credentials but has no known public exploit.
Anviz CrossChex Standard time and attendance software transmits database credentials in plaintext when attackers downgrade TDS7 PreLogin protocol encryption, enabling remote unauthenticated access to backend databases containing employee data and access control records. CVSS 7.5 (High) with network attack vector and no prerequisites. Reported by CISA ICS-CERT, indicating industrial/physical security context. EPSS and KEV status not provided in available data.
OpenSSL and Microsoft products using the 'DEFAULT' keyword in TLS 1.3 key exchange group configurations may negotiate weaker cryptographic groups than intended, allowing network-based attackers to potentially downgrade the security of encrypted connections without authentication or user interaction. This affects servers that combine default group lists with custom configurations, particularly impacting hybrid post-quantum key exchange implementations where clients defer group selection. A patch is available to remediate this high-severity confidentiality risk.