CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Last updated
Overview
Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
Real-world CVEs
66 recorded CVEs are caused by CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints). The highest-severity and most recent are shown first. 24 new CWE-923 CVEs have been recorded so far in 2026 (17 in 2025).
- CVE-2026-62836
Azure SQL Managed Instance Elevation of Privilege Vulnerability
Critical · CVSS 10.0 · EPSS 36th2026-08-06 - CVE-2019-17440Critical · CVSS 10.0 · EPSS 75th2019-12-20
- CVE-2024-41889Critical · CVSS 9.8 · EPSS 50th2024-08-05
- CVE-2026-34205
Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode
Critical · CVSS 9.7 · EPSS 17th2026-03-27 - CVE-2017-3891Critical · CVSS 9.6 · EPSS 68th2017-11-14
- CVE-2022-43916Critical · CVSS 9.1 · EPSS 19th2025-01-30
- CVE-2023-28078Critical · CVSS 9.1 · EPSS 57th2024-02-15
- CVE-2025-20261
Cisco Integrated Management Controller Privilege Escalation Vulnerability
High · CVSS 8.8 · EPSS 37th2025-06-04 - CVE-2025-61939
Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended Endpoints
High · CVSS 8.7 · EPSS 16th2026-01-07 - CVE-2026-8920High · CVSS 8.5 · EPSS 2th2026-07-15
- CVE-2025-58742
Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture
High · CVSS 8.5 · EPSS 6th2026-01-20 - CVE-2024-26131
Element Android Intent Redirection
High · CVSS 8.4 · EPSS 39th2024-02-20
Showing 12 of 66 recorded CWE-923 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-923 vulnerabilitiesCommon consequences
What can happen when CWE-923 is exploited.
Gain Privileges or Assume Identity
Affects: Integrity, Confidentiality
If an attacker can spoof the endpoint, the attacker gains all the privileges that were intended for the original endpoint.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Technologies
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
These cross-domain policy files mean to allow Flash and Silverlight applications hosted on other domains to access its data:
Vulnerable example
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"Vulnerable example
<?xml version="1.0" encoding="utf-8"?>This Android application will remove a user account when it receives an intent to do so:
Vulnerable example
IntentFilter filter = new IntentFilter("com.example.RemoveUser");This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2022-30319 — S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
- CVE-2022-22547 — A troubleshooting tool exposes a web server on a random port between 9000-65535 that could be used for information gathering
- CVE-2022-4390 — A WAN interface on a router has firewall restrictions enabled for IPv4, but it does not for IPv6, which is enabled by default
- CVE-2012-2292 — Product has a Silverlight cross-domain policy that does not restrict access to another application, which allows remote attackers to bypass the Same Origin Policy.
- CVE-2012-5810 — Mobile banking application does not verify hostname, leading to financial loss.
- CVE-2014-1266 — Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.
- CVE-2000-1218 — DNS server can accept DNS updates from hosts that it did not query, leading to cache poisoning
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-923.
- What is CWE-923?
- The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
- What CVEs are caused by CWE-923?
- 66 recorded CVEs are attributed to CWE-923, including CVE-2026-62836, CVE-2019-17440, CVE-2024-41889.
- How is CWE-923 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-923?
- Exploiting CWE-923 can lead to: Gain Privileges or Assume Identity.
- Is CWE-923 actively exploited?
- 66 recorded CVEs are caused by CWE-923; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-923) (opens in a new tab)
- CWE-923 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-923
Get alerted the moment a new CWE-923 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.