Falhas do tipo CWE-923

86 resultados

Falta de restrição adequada do canal de comunicação aos endpoints pretendidos

A aplicação não valida ou restringe corretamente com quem está se comunicando, permitindo que dados sejam enviados ou recebidos de endpoints não autorizados. Isso abre caminho para ataques de man-in-the-middle, desvio de tráfego ou acesso a informações sensíveis por atores não pretendidos.

Exemplo

Uma app móvel se conecta a um servidor backend sem validar certificados SSL, aceitando conexões de qualquer servidor que se apresente com o nome correto. Um atacante na rede local intercepta e redireciona o tráfego para sua própria máquina, capturando credenciais e dados do usuário.

Como mitigar

Implemente validação rigorosa de certificados SSL/TLS (verificar chain, hostname e data), use pinning de certificados em apps críticas, e enforce HTTPS com headers HSTS. No backend, restrinja comunicação apenas aos IPs e domínios conhecidos, use firewalls e VPNs para isolamento de rede.

CVE-2024-39537MEDIUMJunos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the networkEPSS 0.3%CVE-2025-49734HIGHPowerShell Direct Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-101891CRITICALWatchGuard AP Improper Access Control in API Service Allows Unauthenticated AccessEPSS 0.3%CVE-2026-57028MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2025-62843LOWQuRouterEPSS 0.3%CVE-2025-29986HIGHDell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulneraEPSS 0.3%CVE-2026-92172HIGHPrior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horiEPSS 0.3%CVE-2026-92173CRITICALPrior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculuEPSS 0.3%CVE-2026-102085MEDIUMJunos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerEPSS 0.3%CVE-2022-43916MEDIUMIBM App Connect Enterprise Certified Container improper communications restrictionEPSS 0.3%CVE-2025-61939HIGHColumbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2025-23178HIGHRibbon Communications - CWE-923: Improper Restriction of Communication Channel to Intended EndpointsEPSS 0.3%CVE-2026-70212HIGHWindows Security Center Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-34205CRITICALHome Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network ModeEPSS 0.3%CVE-2023-25518HIGH NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with pEPSS 0.3%CVE-2024-39271LOWImproper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software beforeEPSS 0.3%CVE-2026-102727MEDIUMFTP Passive Data Connection Not Bound to the Authenticated Control PeerEPSS 0.2%CVE-2026-59841MEDIUMA improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 maEPSS 0.2%CVE-2024-22315MEDIUMIBM Fusion improper communication restrictionEPSS 0.2%CVE-2024-36252MEDIUMImproper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If EPSS 0.2%