CWEweakness

CWE-605 Multiple Binds to the Same Port

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.

Common consequences

• Confidentiality, Integrity: Read Application Data — An attacker could access the TCP connection or UDP packets for a different service. Packets from a variety of network services may be stolen or the services spoofed.

Potential mitigations

• [Policy] Restrict server socket address to known local addresses.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Related

Child of · CWE (2)

  • CWE-666 Operation on Resource in Wrong Phase of Lifetime weakness
  • CWE-675 Multiple Operations on Resource in Single-Operation Context weakness

Referenced by CVE · weakness (3)

  • CVE-2026-25086 Under certain conditions, an attacker could bind to the same port used by WebCTRL. vulnerability
  • CVE-2025-15320 Tanium addressed a denial of service vulnerability in Tanium Client. vulnerability
  • CVE-2024-30218 The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a… vulnerability

Referenced by CWE · has member (1)