Weaknesses of type CWE-923

86 results

Restrição inadequada do canal de comunicação aos pontos finais pretendidos

A aplicação falha em validar ou restringir adequadamente para quem está enviando ou recebendo dados, permitindo que comunicações cheguem a endpoints não autorizados. Isso ocorre quando não há verificação suficiente de origem, destino ou identidade das partes na comunicação, criando brechas para interceptação, redirecionamento ou acesso por terceiros.

Example

Um serviço de microserviços que se comunica via gRPC sem validar certificados TLS, permitindo que um atacante na mesma rede se passe por outro serviço legítimo e intercepte requisições sensíveis. Ou uma API que não valida o referer/origin e permite requisições de domínios arbitrários, viabilizando CSRF ou roubo de dados.

How to mitigate

Implemente validação explícita de origem/identidade (certificados mTLS, tokens assinados, IP whitelisting conforme contexto); use canais criptografados e autenticados (TLS, HTTPS obrigatório); valide headers como Origin, Referer e implemente CORS restritivo; autentique ambos os lados da comunicação, nunca confiando implicitamente na rede.

CVE-2024-39537MEDIUMJunos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the networkEPSS 0.3%CVE-2025-49734HIGHPowerShell Direct Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-101891CRITICALWatchGuard AP Improper Access Control in API Service Allows Unauthenticated AccessEPSS 0.3%CVE-2026-57028MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2025-62843LOWQuRouterEPSS 0.3%CVE-2025-29986HIGHDell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulneraEPSS 0.3%CVE-2026-92172HIGHPrior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horiEPSS 0.3%CVE-2026-92173CRITICALPrior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculuEPSS 0.3%CVE-2026-102085MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2022-43916MEDIUMIBM App Connect Enterprise Certified Container improper communications restrictionEPSS 0.3%CVE-2025-61939HIGHColumbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2025-23178HIGHRibbon Communications - CWE-923: Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2026-70212HIGHWindows Security Center Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-34205CRITICALHome Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network ModeEPSS 0.3%CVE-2023-25518HIGH NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with pEPSS 0.3%CVE-2024-39271LOWImproper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software beforeEPSS 0.3%CVE-2026-102727MEDIUMFTP Passive Data Connection Not Bound to the Authenticated Control PeerEPSS 0.2%CVE-2026-59841MEDIUMA improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 maEPSS 0.2%CVE-2024-22315MEDIUMIBM Fusion improper communication restrictionEPSS 0.2%CVE-2024-36252MEDIUMImproper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If EPSS 0.2%