Skip to content
OpenAdvisories

Weakness (CWE)

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

Class Incomplete

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

More detail

While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.

Source: MITRE CWE-923

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-86345

    389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

    A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose r…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-92173

    Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent …

    Meta Platforms Meta Horizon OS
  • Critical 9.3
    CVE-2026-101891

    WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

    An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

    WatchGuard WatchGuard AP
  • Critical 9.7
    CVE-2026-34205

    Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode

    Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the lo…

    home-assistant Home Assistant Supervisor Home Assistant Operating System
  • Critical 9.1
    CVE-2023-28078

    Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A …

    Dell Dell SmartFabric OS10
  • Critical 10.0
    CVE-2019-17440

    PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access

    Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0…

    Palo Alto Networks PAN-OS Network devices
  • Critical 9.6
    CVE-2017-3891

    In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default con…

    BlackBerry QNX Software Development Platform (QNX SDP)
  • Critical 9.1
    CVE-2015-8914

    OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

    The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source …

    neutron neutron Debian PyPI