Impact of a Static Initialization Vector in AES-CBC

CAS-005 By islever Editorial Last updated

Given a scenario, implement security in the early stages of the systems life cycle and throughout subsequent stages. Given a scenario, integrate appropriate controls in the design of a secure architecture.

Short answer

A An attacker could derive plaintext from the protected data due to the loss of semantic security caused by a predictable IV.

Question

The following vulnerability was detected during a recent SAST scan of an application that provides an encrypted tunnel between sites:
Cipher Block Chaining Initialization Vector must be unpredictable.
This vulnerability was found on the following lines of the source code:
iv = b"CompTIAIV202512"
cipher= Cipher(Algorithms.AES(key), modes.CBC(iv))
Which of the following is the potential impact of this vulnerability?
  1. An attacker could derive plaintext from the protected data. Correct Answer
  2. An attacker could predict future key material.
  3. An attacker could tamper with the value sent in the Initialization Vector variable.
  4. An attacker could use a DoS by predicting the Initialization Vector and tampering with its value.

Key Takeaways

This question tests the cryptographic impact of a hardcoded IV in CBC mode, where the main trap is confusing confidentiality loss (plaintext derivation) with integrity or availability issues like tampering or DoS.

A static or predictable Initialization Vector (IV) in AES-CBC mode violates semantic security, allowing attackers to derive plaintext information from the encrypted data.

Common mistake: Choosing C or D, assuming the vulnerability allows tampering with the IV variable or causes a DoS, rather than recognizing the core cryptographic failure of plaintext disclosure.

Expert Analysis

Predictable IV Vulnerability

The provided code uses a hardcoded Initialization Vector (iv = b"CompTIAIV202512") for AES in Cipher Block Chaining (CBC) mode. By definition, a CBC IV must be cryptographically random and unpredictable for each encryption operation to maintain semantic security (IND-CPA).

Cryptographic Impact

When an IV is static or predictable, identical plaintext blocks produce identical ciphertext blocks, leaking structural information. More critically, it allows an attacker to perform a chosen-plaintext attack to verify guesses about the contents of an encrypted message, effectively allowing them to derive plaintext from the protected data. The community comments correctly point out that a predictable IV compromises cryptographic randomness, enabling plaintext derivation.

Eliminating Distractors

Option B is incorrect because the IV is independent of the key generation process. Option C is incorrect because the IV is hardcoded in the source code, not a dynamic variable sent over the network that an attacker can easily tamper with in transit. Option D incorrectly conflates predicting the IV with a Denial of Service (DoS) attack, which is not the recognized cryptographic consequence of this flaw. Option A accurately reflects the loss of confidentiality resulting from this implementation error.

Official Reference

https://cwe.mitre.org/data/definitions/329.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing cryptographic vulnerabilities in code, strictly map the flaw to its formal cryptographic definition. A predictable IV in CBC mode directly violates IND-CPA (semantic security), which translates to the ability to derive plaintext or distinguish messages. Avoid distractors related to integrity or availability unless a specific bit-flipping or padding oracle context is explicitly provided.

Community Votes

A
63%
D
37%

63% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. jamestkd 👍 1 Answered A
    The correct answer is A. An attacker could derive plaintext from the protected data. Explanation: The Vulnerability: The code uses a static, hard-coded Initialization Vector (iv = b"CompTIAIV202512") with AES in Cipher Block Chaining (CBC) mode. The Impact: In CBC mode, a predictable or reused IV compromises cryptographic randomness across cipher blocks. It allows an attacker to perform chosen-plaintext attacks, detect patterns or repeated blocks in the ciphertext, and potentially decrypt or derive sensitive plaintext from the protected data stream.
  2. Skri113xX 👍 1 Answered D
    I’m thinking it’s D, but not 100%. The question could be interpreted in two ways.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cloud Security Logic Flaw: False Negative in Device Compliance

S-grade

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide