Weakness (CWE)
CWE-419: Unprotected Primary Channel
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
How to prevent it (2 mitigations)
-
Architecture and Design
Do not expose administrative functionality on the user UI.
-
Architecture and Design
Protect the administrative/restricted functionality with a strong authentication mechanism.
Source: MITRE CWE-419
12 results · Feed
-
Low 2.2
HCL BigFix IVR is impacted by an improper service binding configuration
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local a…
-
High 7.1
Envoy Admin Interface Exposed through prometheus metrics endpoint
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed…
-
Critical 9.8
Unprotected Exposed Firebird Database with default credentials
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other s…
-
Low 3.7
TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App commu…
-
High 7.5
Z/IP Gateway Device Reset Locally Denial of Service Vulnerability
Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.
-
High 8.8
Unprotected Primary Channel vulnerability in Movistar 4G router
The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges.
-
Medium 6.5
Silicon Labs PC Controller Denial of Service Vulnerability
Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability …
-
High 7.2
Spigot Command Exploit in Triton
Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee br…
-
Medium 5.3
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotec…
-
Medium 6.5CVE-2019-11248 EPSS 75%
Kubernetes kubelet exposes /debug/pprof info on healthz port
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory …
-
Unscored —
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugge…
-
Unscored —
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an E…