CWEweakness
CWE-419 Unprotected Primary Channel
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
Common consequences
• Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism
Potential mitigations
• [Architecture and Design] Do not expose administrative functionality on the user UI.
• [Architecture and Design] Protect the administrative/restricted functionality with a strong authentication mechanism.
Related
Attack pattern · CAPEC (1)
- CAPEC-383 Harvesting Information via API Event Monitoring attack pattern
Child of · CWE (1)
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints weakness
Referenced by CAPEC · weakness (1)
- CAPEC-383 Harvesting Information via API Event Monitoring attack pattern
Referenced by CVE · weakness (12)
- CVE-2025-31964 Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact… vulnerability
- CVE-2025-24030 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. vulnerability
- CVE-2024-50588 An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA… vulnerability
- CVE-2024-39886 TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. vulnerability
- CVE-2024-3051 Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. vulnerability
- CVE-2024-2414 The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. vulnerability
- CVE-2023-6533 Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has… vulnerability
- CVE-2023-30859 Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. vulnerability
- CVE-2022-33932 Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel… vulnerability
- CVE-2019-11248 The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. vulnerability
- CVE-2018-12120 Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with… vulnerability
- CVE-2018-12539 In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM… vulnerability