CWEweakness

CWE-480 Use of Incorrect Operator

Low Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Likelihood of exploit
Low
Languages
C, C++, Not Language-Specific, Perl
CWE version
5.0

Description

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Common consequences

• Other: Alter Execution Logic — This weakness can cause unintended logic to be executed and other unexpected application behavior.

Detection methods

• Automated Static Analysis: This weakness can be found easily using static analysis. However in some cases an operator might appear to be incorrect, but is actually correct and reflects unusual logic within the program. • Manual Static Analysis: This weakness can be found easily using static analysis. However in some cases an operator might appear to be incorrect, but is actually correct and reflects unusual logic within the program.

Observed examples

• CVE-2022-3979: Chain: data visualization program written in PHP uses the "!=" operator instead of the type-strict "!==" operator (CWE-480) when validating hash values, potentially leading to an incorrect type conversion (CWE-704) • CVE-2021-3116: Chain: Python-based HTTP Proxy server uses the wrong boolean operators (CWE-480) causing an incorrect comparison (CWE-697) that identifies an authN failure if all three conditions are met instead of only one, allowing bypass of the proxy authentication (CWE-1390)

Related

Observed example · CVE (2)

  • CVE-2022-3979 A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. vulnerability
  • CVE-2021-3116 before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data… vulnerability

Child of · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

Referenced by CVE · weakness (11)

  • CVE-2026-83525 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all… vulnerability
  • CVE-2026-79643 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Incorrect… vulnerability
  • CVE-2026-63421 Keystone is a content management system for Node.js. vulnerability
  • CVE-2026-44722 pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. vulnerability
  • CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. vulnerability
  • CVE-2026-48497 Envoy is an open source edge and service proxy designed for cloud-native applications. vulnerability
  • CVE-2026-43114 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on… vulnerability
  • CVE-2026-4748 A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the… vulnerability
  • CVE-2025-52985 A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated,… vulnerability
  • CVE-2024-35190 Asterisk is an open source private branch exchange and telephony toolkit. vulnerability
  • CVE-2022-1947 Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. vulnerability

Referenced by CWE · child of (4)

  • CWE-1077 Floating Point Comparison with Incorrect Operator weakness
  • CWE-481 Assigning instead of Comparing weakness
  • CWE-482 Comparing instead of Assigning weakness
  • CWE-597 Use of Wrong Operator in String Comparison weakness

Referenced by CWE · has member (1)