Fallos del tipo CWE-1327

33 resultados

Vinculação a endereço IP irrestrito

Ocorre quando uma aplicação se vincula a 0.0.0.0 ou :: (IPv6) sem restrição, expondo serviços internos à rede inteira ou à internet. O problema é que o desenvolvedor não restringe quem pode acessar o serviço, tornando-o acessível de qualquer origem quando não deveria estar.

Ejemplo

Um servidor de debug ou ferramenta administrativa vincula-se a 0.0.0.0:9200 durante o desenvolvimento e vai para produção assim, permitindo que qualquer pessoa na rede (ou internet, se exposto) acesse funcionalidades sensíveis sem autenticação ou com controles fracos.

Cómo mitigar

Vincule serviços apenas a localhost (127.0.0.1 ou ::1) se forem locais, ou a IPs específicos e privados se precisarem ser acessíveis internamente. Se for expor na rede, combine com autenticação forte, firewall e controle de acesso na camada de rede.

CVE-2024-47176MEDIUMcups-browsed binds to `INADDR_ANY:631`, trusting any packet from any sourceEPSS 50.6%CVE-2026-82456CRITICALargocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTPEPSS 2.4%CVE-2023-1968CRITICALCVE-2023-1968EPSS 1.8%CVE-2026-59177HIGHESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfacesEPSS 1.2%CVE-2026-112346CRITICALOpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCEEPSS 1.0%CVE-2026-57123CRITICALPraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inEPSS 0.9%CVE-2026-20212CRITICALCisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-36105MEDIUMdbt allows Binding to an Unrestricted IP Address via socketsocketEPSS 0.7%CVE-2026-75021HIGHfastify-cli vulnerable to remote code execution via ignored explicit Inspector bind addressEPSS 0.7%CVE-2025-3621CRITICALRemote Code Execution in ProTNS ActADUREPSS 0.7%CVE-2025-61934CRITICALAutomationDirect Productivity Suite Binding to an Unrestricted IP Address CWE-1327EPSS 0.7%CVE-2026-24015CRITICALApache IoTDB: Insecure Default Configuration VulnerabilityEPSS 0.6%CVE-2026-21528MEDIUMAzure IoT Explorer Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-100868MEDIUMPenpot before 2.18.0 Unauthenticated WebSocket Access via MCP BridgeEPSS 0.5%CVE-2026-92559CRITICALIBM App Connect Enterprise is vulnerable to a credential exposureEPSS 0.5%CVE-2023-41742MEDIUMExcessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, WinEPSS 0.5%CVE-2026-16713MEDIUMIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionEPSS 0.5%CVE-2026-28395MEDIUMOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrlEPSS 0.5%CVE-2023-5398MEDIUMServer receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell SecurityEPSS 0.4%CVE-2026-16503CRITICALVPS.org one-click Supabase template deployment instance contains multiple vulnerabilitiesEPSS 0.4%