---
cve: "CVE-2026-116054"
severity: "LOW"
cvss: 2.1
epss: "0.2%"
vendor: "n/a"
kev: false
exploited: false
published: "2026-10-25 15:17:01"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T20:57:00+01:00"
---

# CVE-2026-116054

> 2.1 LOW

## Beschreibung

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulDB**
- State: PUBLISHED
- Stand: 2026-10-25 14:15:11
- CNA-CVSS: **2.1** (`CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P`)

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-326** — Inadequate Encryption Strength
  The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- **CWE-916** — Use of Password Hash With Insufficient Computational Effort
  The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

## Angriffsmuster (CAPEC)

- [CAPEC-20 — Encryption Brute Forcing](https://capec.mitre.org/data/definitions/20.html) _(Severity: Low)_
- [CAPEC-112 — Brute Force](https://capec.mitre.org/data/definitions/112.html) _(Severity: High)_
- [CAPEC-192 — Protocol Analysis](https://capec.mitre.org/data/definitions/192.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1110 — Brute Force](https://attack.mitre.org/techniques/T1110/)

## Referenzen

- <https://vuldb.com/vuln/426138>
- <https://vuldb.com/vuln/426138/cti>
- <https://vuldb.com/cve/CVE-2026-116054>
- <https://vuldb.com/submit/997072>
- <https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-116054/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_