cve.bz

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

Filter

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

What the weakness is: CWE-923 at MITRE. All weaknesses

Related attack patterns (CAPEC): 4
  • CAPEC-161 Infrastructure Manipulation Severity: High
  • CAPEC-481 Contradictory Destinations in Traffic Routing Schemes Likelihood: Medium · Severity: High
  • CAPEC-501 Android Activity Hijack Severity: Medium
  • CAPEC-697 DHCP Spoofing Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-923, as MITRE names them. Credits.

Ask an AI about CWE-923

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-923: Improper Restriction of Communication Channel to Intended Endpoints and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/923.html and https://cve.bz/cve/cwe/923?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2026-125361EPSS 0.1%

    Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification…

  2. 7.7CVE-2026-10756EPSS 0.2%

    TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with loca…

  3. 5.0CVE-2026-110909EPSS 0.1%

    Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code sub…

  4. 6.9CVE-2026-102085EPSS 0.3%

    An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact t…

  5. 8.2CVE-2026-85925EPSS 0.5%

    Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

  6. 7.0CVE-2026-70212EPSS 0.3%

    Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.

  7. 9.0CVE-2026-86345EPSS 0.4%

    A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS…

  8. 9.1CVE-2026-92173EPSS 0.3%

    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. Tha…

  9. 8.8CVE-2026-92172EPSS 0.3%

    Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSH…

  10. 6.0CVE-2026-102727EPSS 0.2%

    In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without checking that it comes from the client that requested passive mode. An unauthenticated network attac…

  11. 9.3CVE-2026-101891EPSS 0.3%

    An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

  12. 5.3CVE-2026-82932EPSS 0.2%

    mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network c…

  13. 8.2CVE-2026-96454EPSS 0.5%

    Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-t…

  14. 5.7CVE-2026-91166EPSS 0.2%

    Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passe…

  15. 8.6CVE-2026-78501EPSS 0.5%

    Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

  16. 6.3CVE-2026-81871EPSS 0.2%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate e…

  17. 6.3CVE-2026-90461EPSS 0.4%

    OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

  18. 7.5CVE-2026-87734EPSS 0.5%

    An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.

  19. 7.4CVE-2026-13608EPSS 0.5%

    A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a pr…

  20. 10.0CVE-2026-62836EPSS 0.6%

    Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

  21. 7.1CVE-2026-18655EPSS 0.4%

    Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ…

  22. 7.3CVE-2026-23904EPSS 0.9%

    Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachabl…

  23. 6.9CVE-2026-63226EPSS 0.4%

    Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations. When SSH is enabled on an affected product, SSH port forwarding…

  24. 8.5CVE-2026-8920EPSS 0.1%

    Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file …

  25. 7.5CVE-2026-59841EPSS 0.2%

    A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here>

  26. 6.9CVE-2026-57028EPSS 0.3%

    An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to an incorrect initialization, …

  27. 6.9CVE-2026-33803EPSS 0.4%

    An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact t…

  28. 6.1CVE-2026-55655EPSS 0.1%

    A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a …

  29. 5.7CVE-2026-12539EPSS 0.1%

    Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arb…

  30. 5.7CVE-2026-12039EPSS 0.1%

    Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server forwards any queried name to the host resolver whenever the network is internet-connected, without…

  31. 5.3CVE-2025-36145EPSS 0.2%

    IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.

  32. 5.0CVE-2026-22726EPSS 0.2%

    Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure a route-service that would allow it to …

  33. 7.5CVE-2025-36180EPSS 0.2%

    IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.

  34. 9.6CVE-2026-34205EPSS 0.3%

    Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge…

  35. 5.5CVE-2025-36438EPSS 0.1%

    IBM Concert 1.0.0 through 2.2.0 could allow a privileged user to perform unauthorized actions due to improper restriction of channel communication to intended endpoints.

  36. 5.9CVE-2026-32318EPSS 0.08%

    Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-t…

  37. 5.9CVE-2026-32317EPSS 0.07%

    Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man…

  38. 5.9CVE-2026-32303EPSS 0.1%

    Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub ke…

  39. 0.9CVE-2025-62843EPSS 0.3%

    An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gains physical access, they can then exploit the vulnerability to gain the privileges that were intended…

  40. 7.5CVE-2026-23664EPSS 1.1%

    Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.

  41. 2.4CVE-2025-27769EPSS 0.2%

    A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging Station (All versions < L4.10.1). Affected devices contain improper access control that could allow …

  42. 5.9CVE-2026-22715EPSS 0.2%

    VMWare Workstation and Fusion contain a logic flaw in the management of network packets.  Known attack vectors: A malicious actor with administrative privileges on a Guest VM may be able to interrupt or intercept network connections of ot…

  43. 8.5CVE-2025-58742EPSS 0.2%

    Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by m…

  44. 8.7CVE-2025-61939EPSS 0.3%

    An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS resp…

  45. 6.2CVE-2025-33176EPSS 0.2%

    NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adjacent network. A successful exploit of this vulnerability might lead to escalation of privileges, …

  46. 5.3CVE-2025-12357EPSS 0.8%

    By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. Th…

  47. 7.0CVE-2025-49734EPSS 0.3%

    Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.

  48. 6.7CVE-2025-48807EPSS 0.6%

    Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally.

  49. 6.9CVE-2025-35978EPSS 0.1%

    Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary r…

  50. 5.3CVE-2025-22251EPSS 0.4%

    An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unau…