Fallos del tipo CWE-923

86 resultados

Restrição inadequada de canal de comunicação para endpoints pretendidos

Ocorre quando a aplicação não valida corretamente se está se comunicando com o endpoint correto, permitindo que um atacante intercepte, redirecione ou substitua a comunicação. O código assume que está falando com o servidor legítimo sem verificar identidade, certificados ou origem, criando janelas para man-in-the-middle ou redirecionamento malicioso.

Ejemplo

Uma app mobile conecta a um servidor via HTTP sem validar certificado SSL/TLS, ou aceita qualquer certificado autoassinado. Um atacante na mesma rede WiFi intercepta a conexão e serve credenciais falsas; a app não detecta porque não verificou a autenticidade do servidor.

Cómo mitigar

Sempre validar certificados SSL/TLS (fixar certificado público se possível), usar HTTPS obrigatório, implementar verificação de hostname, e em APIs internas usar autenticação mútua (mTLS). Nunca confiar em claims do servidor sem validação criptográfica.

CVE-2024-39537MEDIUMJunos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the networkEPSS 0.3%CVE-2025-49734HIGHPowerShell Direct Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-101891CRITICALWatchGuard AP Improper Access Control in API Service Allows Unauthenticated AccessEPSS 0.3%CVE-2026-57028MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2025-62843LOWQuRouterEPSS 0.3%CVE-2025-29986HIGHDell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulneraEPSS 0.3%CVE-2026-92172HIGHPrior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horiEPSS 0.3%CVE-2026-92173CRITICALPrior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculuEPSS 0.3%CVE-2026-102085MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2022-43916MEDIUMIBM App Connect Enterprise Certified Container improper communications restrictionEPSS 0.3%CVE-2025-61939HIGHColumbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2025-23178HIGHRibbon Communications - CWE-923: Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2026-70212HIGHWindows Security Center Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-34205CRITICALHome Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network ModeEPSS 0.3%CVE-2023-25518HIGH NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with pEPSS 0.3%CVE-2024-39271LOWImproper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software beforeEPSS 0.3%CVE-2026-102727MEDIUMFTP Passive Data Connection Not Bound to the Authenticated Control PeerEPSS 0.2%CVE-2026-59841MEDIUMA improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 maEPSS 0.2%CVE-2024-22315MEDIUMIBM Fusion improper communication restrictionEPSS 0.2%CVE-2024-36252MEDIUMImproper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If EPSS 0.2%