The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Primary

Resultant

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Architecture and Design
For hardware, this may be introduced when design does not plan for an attacker having physical access while a legitimate user is remotely operating the device.

Operation

System Configuration

High

Integrity
Confidentiality
Read Application Data
Modify Files or Directories
Anyone can read the information by gaining access to the channel being used for communication. Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination, whether across the internet, an internal network, the cloud, etc. Some actors might have privileged access to a network interface or any link along the channel, such as a router, but they might not be authorized to collect the underlying data. As a result, network traffic could be sniffed by adversaries, spilling security-critical data.

Integrity
Confidentiality
Read Application Data
Modify Files or Directories
Other
When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Black Box

Use monitoring tools that examine the software's process as it interacts with the operating system and the network. This technique is useful in cases when source code is unavailable, if the software was not developed by you, or if you want to verify that the build phase did not introduce any new weaknesses. Examples include debuggers that directly attach to the running process; system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and sniffers and protocol analyzers that monitor network traffic.
Attach the monitor to the process, trigger the feature that sends the data, and look for the presence or absence of common cryptographic functions in the call tree. Monitor the network and determine if the data packets contain readable commands. Tools exist for detecting if certain encodings are in use. If the traffic contains high entropy, this might indicate the usage of encryption.

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.

Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.

Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those recommended by NIST) protect paths from security critical data to trusted user applications.

Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.

Operation
Configure servers to use encrypted channels for communication, which may include SSL or other secure protocols.

The following code attempts to establish a connection to a site to communicate sensitive information.

try {URL u = new URL("http://www.secret.example.org/");HttpURLConnection hu = (HttpURLConnection) u.openConnection();hu.setRequestMethod("PUT");hu.connect();OutputStream os = hu.getOutputStream();hu.disconnect();}catch (IOException e) {
//...

}

Though a connection is successfully made, the connection is unencrypted and it is possible that all sensitive data sent to or received from the server will be read by unintended actors.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple vendors used cleartext transmission of sensitive information in their OT products.

A TAP accessible register is read/written by a JTAG based tool, for internal use by authorized users. However, an adversary can connect a probing device and collect the values from the unencrypted channel connecting the JTAG interface to the authorized user, if no additional protections are employed.

The following Azure CLI command lists the properties of a particular storage account:

az storage account show -g {ResourceGroupName} -n {StorageAccountName}

The JSON result might be:

{

"name": "{StorageAccountName}",
"enableHttpsTrafficOnly": false,
"type": "Microsoft.Storage/storageAccounts"

}

The enableHttpsTrafficOnly value is set to false, because the default setting for Secure transfer is set to Disabled. This allows cloud storage resources to successfully connect and transfer data without the use of encryption (e.g., HTTP, SMB 2.1, SMB 3.0, etc.).
Azure's storage accounts can be configured to only accept requests from secure connections made over HTTPS. The secure transfer setting can be enabled using Azure's Portal (GUI) or programmatically by setting the enableHttpsTrafficOnly property to True on the storage account, such as:

az storage account update -g {ResourceGroupName} -n {StorageAccountName} --https-only true

The change can be confirmed from the result by verifying that the enableHttpsTrafficOnly value is true:

{

"name": "{StorageAccountName}",
"enableHttpsTrafficOnly": true,
"type": "Microsoft.Storage/storageAccounts"

}

Note: to enable secure transfer using Azure's Portal instead of the command line:

Open the Create storage account pane in the Azure portal.
In the Advanced page, select the Enable secure transfer checkbox.

CVE-2022-29519
Programmable Logic Controller (PLC) sends sensitive information in plaintext, including passwords and session tokens.
https://www.cve.org/CVERecord?id=CVE-2022-29519

CVE-2022-30312
Building Controller uses a protocol that transmits authentication credentials in plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-30312

CVE-2022-31204
Programmable Logic Controller (PLC) sends password in plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-31204

CVE-2002-1949
Passwords transmitted in cleartext.
https://www.cve.org/CVERecord?id=CVE-2002-1949

CVE-2008-4122
Chain: Use of HTTPS cookie without "secure" flag causes it to be transmitted across unencrypted HTTP.
https://www.cve.org/CVERecord?id=CVE-2008-4122

CVE-2008-3289
Product sends password hash in cleartext in violation of intended policy.
https://www.cve.org/CVERecord?id=CVE-2008-3289

CVE-2008-4390
Remote management feature sends sensitive information including passwords in cleartext.
https://www.cve.org/CVERecord?id=CVE-2008-4390

CVE-2007-5626
Backup routine sends password in cleartext in email.
https://www.cve.org/CVERecord?id=CVE-2007-5626

CVE-2004-1852
Product transmits Blowfish encryption key in cleartext.
https://www.cve.org/CVERecord?id=CVE-2004-1852

CVE-2008-0374
Printer sends configuration information, including administrative password, in cleartext.
https://www.cve.org/CVERecord?id=CVE-2008-0374

CVE-2007-4961
Chain: cleartext transmission of the MD5 hash of password enables attacks against a server that is susceptible to replay (CWE-294).
https://www.cve.org/CVERecord?id=CVE-2007-4961

CVE-2007-4786
Product sends passwords in cleartext to a log server.
https://www.cve.org/CVERecord?id=CVE-2007-4786

CVE-2005-3140
Product sends file with cleartext passwords in e-mail message intended for diagnostic purposes.
https://www.cve.org/CVERecord?id=CVE-2005-3140

Plaintext Transmission of Sensitive Information

SEC06-J
Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar

SER02-J
Sign then seal sensitive objects before sending them outside a trust boundary

SFP23
Exposed Data

Part 3-3
Req SR 4.1

Part 4-2
Req CR 4.1B

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Applicable communication channels are not limited to software products. Applicable channels include hardware-specific technologies such as internal hardware networks and external debug channels, supporting remote JTAG debugging. When mitigations are not applied to combat adversaries within the product's threat model, this weakness significantly lowers the difficulty of exploitation by such adversaries.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-01-12
updated Common_Consequences, Description, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Relationships

CWE Content Team
MITRE
2009-03-10
updated Potential_Mitigations

CWE Content Team
MITRE
2009-05-27
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-02-16
updated References

CWE Content Team
MITRE
2010-04-05
updated Applicable_Platforms, Common_Consequences, Time_of_Introduction

CWE Content Team
MITRE
2010-06-21
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2010-12-13
updated Observed_Examples, Related_Attack_Patterns

CWE Content Team
MITRE
2011-03-29
updated Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2013-02-21
updated Applicable_Platforms, References

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-02-18
updated Related_Attack_Patterns

CWE Content Team
MITRE
2014-06-23
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships

CWE Content Team
MITRE
2018-01-23
updated Abstraction

CWE Content Team
MITRE
2018-03-27
updated References, Relationships, Type

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Relationships, Type

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-06-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Demonstrative_Examples, Description, Maintenance_Notes, Modes_of_Introduction, Potential_Mitigations, References, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Description, Mapping_Notes, Relationships

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Common_Consequences, Description, Diagram, Other_Notes, Relationships

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Maintenance_Notes, Relationships, Weakness_Ordinalities

Accellera IP Security Assurance (IPSA) Working Group
Accellera Systems Initiative
2023-01-24
Submitted original contents of CWE-1324 and reviewed its integration into this entry.

Plaintext Transmission of Sensitive Information