CWEweakness

CWE-236 Improper Handling of Undefined Parameters

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

Common consequences

• Integrity: Unexpected State

Observed examples

• CVE-2002-1488: Crash in IRC client via PART message from a channel the user is not in. • CVE-2001-0650: Router crash or bad route modification using BGP updates with invalid transitive attribute.

Related

Observed example · CVE (2)

  • CVE-2002-1488 The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message… vulnerability
  • CVE-2001-0650 Cisco devices IOS 12.0 and earlier allow a remote attacker to cause a crash, or bad route updates, via malformed BGP updates with… vulnerability

Child of · CWE (1)

  • CWE-233 Improper Handling of Parameters weakness

Referenced by CVE · weakness (2)

  • CVE-2026-57032 An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series… vulnerability
  • CVE-2022-20828 A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an… vulnerability