Weakness (CWE)
CWE-300: Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
How to prevent it (3 mitigations)
-
Implementation
In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Always fully authenticate both ends of any communications channel.
-
Architecture and Design
Adhere to the principle of complete mediation.
-
Implementation
A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.
Source: MITRE CWE-300
67 results · Feed
-
High 7.4
FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtls_state_setup() compared a peer certificate with the SDP…
-
Medium 5.6
Zhonglun CloudPOS Automatic Update Program.cs channel accessible
A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead…
-
High 7.1
Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code wi…
-
Critical 9.2
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from…
-
Critical 9.8CVE-2026-74232 Exploited
Zbtlink MQWrt yunmgrd Cloud C2 Implant
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmwar…
-
High 7.1
CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
-
High 8.7
Multiple vulnerabilities in Ghost Robotics' Vision 60
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and …
-
Medium 4.3
Security Boundary Bypass via Routing Node Impersonation
A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data str…
-
Medium 4.3
Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combine…
-
Medium 4.3
Cross-BSSID GTK Re-encryption and Traffic Injection
A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (…
-
High 7.5
A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware …
-
High 7.4
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions). The affected applica…
-
Critical 9.3
LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception
LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery pr…
-
Medium 5.6
A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 thr…
-
High 8.1
This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacke…
-
High 7.8
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system. This vulnerability is due to insufficient input va…
-
Low 3.0
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versi…
-
Medium 5.9
IBM Cloud Pak System information disclosure
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the network to obtain sensitive information from CLI arguments.
-
Medium 6.2
Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability ma…
-
High 8.1
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
-
Medium 5.3
IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dashboard UI using man in the middle techniques.
-
Medium 6.5
Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client
Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing att…
-
Critical 9.8
ntlk unsafe deserialization vulnerability
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
-
High 7.4
BIG-IP Next Central Manager vulnerability
BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.6
easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle a…
-
High 8.2
Use of Unencrypted HTTP Request in dectalk-tts
dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone…
-
High 8.3
IBM Security Access Manager Container gain access
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to gain access to the underlying system using man in the middl…
-
Medium 5.9
Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
-
High —
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been pat…
-
High 7.8
An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4…
-
Medium 6.5
Multiple vulnerabilities in Open5GS
Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitive information.
-
Medium 6.8
Channel Accessible by Non-Endpoint
A Channel Accessible by Non-Endpoint vulnerability in the Schweitzer Engineering Laboratories SEL Real-Time Automation Controller (RTAC) could allow a remote attacker to perform a man-in-the-middle (MiTM) that could result in denial of service. See the ACSELE…
-
Medium 6.3
An SSL certificate host verification vulnerability affects HCL Verse for Android
Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a pro…
-
Medium 6.5
Junos OS: Certificate validation is skipped when fetching system scripts from a HTTPS URL
An Improper Certificate Validation weakness in the Juniper Networks Junos OS allows an attacker to perform Person-in-the-Middle (PitM) attacks when a system script is fetched from a remote source at a specified HTTPS URL, which may compromise the integrity an…
-
High 7.7
An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy H…
-
Medium 5.3
Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.
A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 …
-
Unscored —
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerab…
-
Medium 5.9
When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the…
-
Unscored —
A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-mi…
-
Medium 4.3
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due…