The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

What CVEs are caused by CWE-1025?

17 recorded CVEs are attributed to CWE-1025, including CVE-2023-54390, CVE-2026-75840, CVE-2025-71377.

How is CWE-1025 detected?

Manual Static Analysis: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

What are the consequences of CWE-1025?

Exploiting CWE-1025 can lead to: Varies by Context.

Is CWE-1025 actively exploited?

17 recorded CVEs are caused by CWE-1025; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-1025: Comparison Using Wrong Factors

RadicalNotion.AI

Code examples

MITRE examples of the weakness in code.

In the example below, two Java String objects are declared and initialized with the same string values. An if statement is used to determine if the strings are equivalent.

Vulnerable example

java

String str1 = new String("Hello");

Safe example

java

if (str1.equals(str2)) {

However, the if statement will not be executed as the strings are compared using the "==" operator. For Java objects, such as String objects, the "==" operator compares object references, not object values. While the two String objects above contain the same string values, they refer to different object references, so the System.out.println statement will not be executed. To compare object values, the previous code could be modified to use the equals method:

CWE-1025: Comparison Using Wrong Factors

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Manual Static Analysis

Code examples

Frequently asked questions

References

Track CWE-1025 CVEs

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Manual Static Analysis

Code examples

Related weaknesses

Parent

Child

Frequently asked questions

References

Track CWE-1025 CVEs