What CVEs are caused by CWE-345?

331 recorded CVEs are attributed to CWE-345, including CVE-2022-26871, CVE-2026-47691, CVE-2026-45674. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Is CWE-345 part of the OWASP Top 10?

CWE-345 maps to OWASP Top Ten 2004: Broken Authentication and Session Management (A3) in the OWASP security taxonomy.

What are the consequences of CWE-345?

Exploiting CWE-345 can lead to: Varies by Context, Unexpected State.

Is CWE-345 actively exploited?

Yes. 1 CWE-345 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 331 recorded CVEs.

Class weakness

Draft

CWE-345: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Last updated May 1, 2026

331

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

CWE-345 (Insufficient Verification of Data Authenticity) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

331 recorded CVEs are caused by CWE-345 (Insufficient Verification of Data Authenticity), including 1 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 99 new CWE-345 CVEs have been recorded so far in 2026 (48 in 2025).

Showing 12 of 331 recorded CWE-345 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-345 vulnerabilities

Common consequences

What can happen when CWE-345 is exploited.

Varies by Context, Unexpected State

Affects: Integrity, Other

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Applies to

Technologies

ICS/OT

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

Multiple vendors did not sign firmware images.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2022-30260 — Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
CVE-2022-30267 — Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
CVE-2022-30272 — Remote Terminal Unit (RTU) does not use signatures for firmware images and relies on insecure checksums

Terminology & mappings

Mapped taxonomies

PLOVER: Insufficient Verification of Data
OWASP Top Ten 2004: Broken Authentication and Session Management (A3) — CWE More Specific fit
WASC: Content Spoofing (12)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-345.

What is CWE-345?: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
What CVEs are caused by CWE-345?: 331 recorded CVEs are attributed to CWE-345, including CVE-2022-26871, CVE-2026-47691, CVE-2026-45674. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Is CWE-345 part of the OWASP Top 10?: CWE-345 maps to OWASP Top Ten 2004: Broken Authentication and Session Management (A3) in the OWASP security taxonomy.
How is CWE-345 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-345?: Exploiting CWE-345 can lead to: Varies by Context, Unexpected State.
Is CWE-345 actively exploited?: Yes. 1 CWE-345 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 331 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-345

Get alerted the moment a new CWE-345 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing