What CVEs are caused by CWE-300?

51 recorded CVEs are attributed to CWE-300, including CVE-2019-3793, CVE-2017-7480, CVE-2009-3555.

Is CWE-300 actively exploited?

51 recorded CVEs are caused by CWE-300; none are currently in CISA's KEV catalog of actively exploited flaws.

Class weakness

Draft

CWE-300: Channel Accessible by Non-Endpoint

Also known as: Adversary-in-the-Middle / AITM, Attacker-in-the-Middle / AITM, Man-in-the-Middle / MITM, Person-in-the-Middle / PITM, Monkey-in-the-Middle

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

In order to establish secure communication between two parties, it is often important to adequately verify the identity of entities at each end of the communication channel. Inadequate or inconsistent verification may result in insufficient or incorrect identification of either communicating entity. This can have negative consequences such as misplaced trust in the entity at the other end of the channel. An attacker can leverage this by interposing between the communicating entities and masquerading as the original entity. In the absence of sufficient verification of identity, such an attacker can eavesdrop and potentially modify the communication between the original entities.

Real-world CVEs

51 recorded CVEs are caused by CWE-300 (Channel Accessible by Non-Endpoint). The highest-severity and most recent are shown first. 3 new CWE-300 CVEs have been recorded so far in 2026 (10 in 2025).

Showing 12 of 51 recorded CWE-300 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-300 vulnerabilities

Common consequences

What can happen when CWE-300 is exploited.

Read Application Data, Modify Application Data, Gain Privileges or Assume Identity

Affects: Confidentiality, Integrity, Access Control

An attacker could pose as one of the entities and read or possibly modify the communication.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

How to prevent it

Practical mitigations for CWE-300, grouped by where in the lifecycle they apply.

Implementation

Always fully authenticate both ends of any communications channel.

Architecture and Design

Adhere to the principle of complete mediation.

Implementation

A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.

How to detect it

Automated Dynamic Analysis

Some tools can act as proxy servers that allow the tester to intercept packets or messages, inspect them, and modify them before sending them to the destination in order to see if the modified packets are still accepted by the receiving component.

Automated Dynamic Analysis

Dynamic Application Security Testing (DAST) tools can be used to detect network traffic without encryption and/or verification. The affected protocol may be subject to Adversary-in-the-Middle attacks. Some tools act as proxy servers that allow the tester to inspect and modify packets/messages to see if they are still accepted by the receiving component.

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) The analysis could identify use of protocols that are subject to Adversary-in-the-Middle attacks.

Effectiveness: Moderate

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the Java snippet below, data is sent over an unencrypted channel to a remote server.

Vulnerable example

java

Socket sock;

By eavesdropping on the communication channel or posing as the endpoint, an attacker would be able to read all of the transmitted data.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2014-1266 — Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Terminology & mappings

Alternate terms

Adversary-in-the-Middle / AITM
Attacker-in-the-Middle / AITM
Man-in-the-Middle / MITM
Person-in-the-Middle / PITM
Monkey-in-the-Middle
Monster-in-the-Middle
Manipulator-in-the-Middle
On-path attack
Interception attack

Mapped taxonomies

PLOVER: Man-in-the-middle (MITM)
WASC: Routing Detour (32)
The CERT Oracle Secure Coding Standard for Java (2011): Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar (SEC06-J)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-300.

What is CWE-300?: The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
What CVEs are caused by CWE-300?: 51 recorded CVEs are attributed to CWE-300, including CVE-2019-3793, CVE-2017-7480, CVE-2009-3555.
How do you prevent CWE-300?: Always fully authenticate both ends of any communications channel.
How is CWE-300 detected?: Automated Dynamic Analysis: Some tools can act as proxy servers that allow the tester to intercept packets or messages, inspect them, and modify them before sending them to the destination in order to see if the modified packets are still accepted by the receiving component.
What are the consequences of CWE-300?: Exploiting CWE-300 can lead to: Read Application Data, Modify Application Data, Gain Privileges or Assume Identity.
Is CWE-300 actively exploited?: 51 recorded CVEs are caused by CWE-300; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-300

Get alerted the moment a new CWE-300 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Dynamic Analysis

Automated Dynamic Analysis

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Peer

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-300