The product compares two entities in a security-relevant context, but the comparison is incorrect.

What CVEs are caused by CWE-697?

64 recorded CVEs are attributed to CWE-697, including CVE-2020-5849, CVE-2025-54336, CVE-2024-24621. 1 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How is CWE-697 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-697?

Exploiting CWE-697 can lead to: Varies by Context.

Is CWE-697 actively exploited?

Yes. 1 CWE-697 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 64 recorded CVEs.

CWE-697: Incorrect Comparison

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

Consider an application in which Truck objects are defined to be the same if they have the same make, the same model, and were manufactured in the same year.

Vulnerable example

java

public class Truck {

Here, the equals() method only checks the make and model of the Truck objects, but the year of manufacture is not included.

This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.

Vulnerable example

/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */

Attack input

plaintext

CWE-697: Incorrect Comparison

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-697

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Child

Related

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-697