CWE-757 is the algorithm downgrade weakness. A protocol lets the parties negotiate which algorithm protects the session, but it does not select the strongest one both sides support.
Any protocol with negotiation is exposed: TLS, SSH, VPNs, and older ones like Telnet.
How it happens
The weaker option exists for compatibility with old clients. If an attacker sitting in the middle can influence the negotiation, or the implementation ranks ciphers badly, the session ends up on the weak choice, and the victim may never know.
MITRE's examples include CVE-2006-4407, where improper prioritization of ciphers led to a weaker one, CVE-2005-2969, a chain in which an SSL/TLS implementation disabled a verification step that enabled a downgrade to a weaker protocol, and CVE-2001-1444, a Telnet implementation that allowed downgrade to weaker authentication and encryption through an adversary in the middle.
What an attacker gains
The recorded consequence is a bypassed protection mechanism. MITRE gives a plain example: if an attacker can force a channel to cleartext instead of strong encryption, they can read it by sniffing instead of cracking anything.
How to find it
Static analysis can find some cases. Practically, test from the outside: try to connect with only old protocol versions and weak ciphers, and see whether the server agrees. If it does, so can an attacker.
How to fix it
MITRE's record carries no mitigation list for this entry, so these are practical steps.
- Set a minimum protocol version and remove weak ciphers instead of merely ranking them lower.
- Prefer the server's strongest choice when picking among those both sides support.
- Retire legacy clients rather than keeping the weak option for them.
# Fix: refuse anything below TLS 1.2
import ssl
ctx = ssl.create_default_context()
ctx.minimum_version = ssl.TLSVersion.TLSv1_2
What a good negotiation looks like
Negotiation is not the problem by itself. Parties with different capabilities need a way to agree. The weakness is in how the agreement is reached and what is allowed to win.
A sound design has three properties. The set of offered algorithms contains nothing you would be unwilling to rely on. The selection picks the strongest option both parties support, instead of the first match or the client's preference. And the negotiation itself is protected, so a person in the middle cannot rewrite the offer without the parties noticing, which is the failure in the Telnet case MITRE cites.
The chain in CVE-2005-2969 is a reminder that a downgrade can ride on another mistake. There, disabling a verification step is what let the weaker protocol through. When reviewing a protocol implementation, look at the checks around negotiation as closely as the cipher list.
For deployed services, schedule a recurring external test that tries old versions and weak ciphers, so a configuration change that quietly re-enables them gets caught.
Quick check
Why not keep weak algorithms enabled but ranked last?
Because an attacker can influence negotiation. If the weak option is accepted at all, it can be forced. Remove it.
