Cyber Resilience

CWE · MITRE source

CWE-347Improper Verification of Cryptographic Signature

Abstraction: Base · CVEs in our corpus: 795

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 9 mapping(s) from 6 framework(s): STIG oracle linux 9 2 (full) · STIG oracle linux 8 2 (full) · STIG rhel 7 2 (mostly) · STIG rhel 8 1 (full) · STIG rhel 9 1 (mostly) · CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A04:2025 Cryptographic Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-17 Public Key Infrastructure Certificates
  • SC-20 Secure Name/Address Resolution Service (Authoritative Source)
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • CM-14 Signed Components
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (7)AI-assisted

Control Title Family Why it addresses this CWE
SC-17Public Key Infrastructure CertificatesSCPKI certificates under an approved policy require cryptographic signature verification on issuance and validation.
SC-20Secure Name/Address Resolution Service (Authoritative Source)SCRequires cryptographic signatures on authoritative data and support for verifying the chain of trust.
SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)SCMandates verification of cryptographic signatures (e.g., DNSSEC RRSIG) on resolution responses, addressing missing or bypassed signature checks.
CM-14Signed ComponentsCMRequires verification of digital signatures using organization-approved certificates before installation, directly preventing improper verification of cryptographic signatures.
SA-19Component AuthenticitySAComponent authenticity commonly depends on cryptographic signatures; the control enforces proper verification of those signatures.
SI-7Software, Firmware, and Information IntegritySIIntegrity tools commonly rely on cryptographic signatures whose improper validation this weakness covers.
SR-11Component AuthenticitySRAuthenticity validation commonly relies on cryptographic signature or certificate checks that this control enforces.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2020-2021 KEV 10.010.00.04362020-06-29
CVE-2026-48558 KEV 10.010.00.11482026-06-12
CVE-2025-59718 KEV 9.99.80.63442025-12-09
CVE-2025-25292 9.79.80.65092025-03-12
CVE-2021-22160 9.49.80.52932021-05-26
CVE-2025-59719 8.79.80.25052025-12-09
CVE-2025-25291 8.69.80.20262025-03-12
CVE-2020-1464 KEV 8.57.80.41132020-08-17
CVE-2024-9487 8.39.10.25312024-10-10
CVE-2024-45409 8.210.00.10682024-09-10
CVE-2021-37160 8.19.80.08232021-08-02
CVE-2021-33885 8.010.00.05582021-08-25
CVE-2018-12356 7.99.80.04592018-06-15
CVE-2018-8955 7.99.80.04262018-10-24
CVE-2018-1000076 7.89.80.02932018-03-13
CVE-2018-16042 7.86.50.82432019-01-18
CVE-2025-59934 7.89.40.08042025-09-26
CVE-2026-40372 7.89.10.11202026-04-21
CVE-2018-0114 7.77.50.42652018-01-04
CVE-2018-5923 7.79.80.02612019-03-27
CVE-2019-6318 7.79.80.02642019-04-11
CVE-2020-1026 7.79.80.02542020-04-15
CVE-2021-37927 7.79.80.02242021-09-22
CVE-2017-2423 7.69.80.01752017-04-02
CVE-2017-3198 7.69.80.01602018-07-09