CWEweakness

CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Common consequences

• Integrity, Confidentiality: Gain Privileges or Assume Identity — Attackers might be able to modify the message and spoof the endpoint by interfering with the data as it crosses the network or by redirecting the connection to a system under their control. If an attacker can spoof the endpoint, they might gain all the privileges that were intended for the original endpoint.

Related

Child of · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

Referenced by CVE · weakness (39)

  • CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters. vulnerability
  • CVE-2026-48106 Arc is an open, SQL-native time-series database for telemetry. vulnerability
  • CVE-2026-68554 Coturn is a free open source implementation of TURN and STUN Server. vulnerability
  • CVE-2026-14681 Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via… vulnerability
  • CVE-2026-13584 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX… vulnerability
  • CVE-2026-54891 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl… vulnerability
  • CVE-2026-12576 DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability. vulnerability
  • CVE-2019-25719 Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower… vulnerability
  • CVE-2026-39827 An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually… vulnerability
  • CVE-2025-29628 A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home… vulnerability
  • CVE-2025-0592 The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and… vulnerability
  • CVE-2024-12399 CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause… vulnerability
  • CVE-2024-8933 CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause… vulnerability
  • CVE-2024-43450 Windows DNS Spoofing Vulnerability vulnerability
  • CVE-2024-52288 libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust… vulnerability
  • CVE-2024-44730 Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat… vulnerability
  • CVE-2024-39229 An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11,… vulnerability
  • CVE-2020-11639 An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. vulnerability
  • CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept,… vulnerability
  • CVE-2023-6408 CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a… vulnerability
  • CVE-2023-49933 An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. vulnerability
  • CVE-2015-0897 LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack… vulnerability
  • CVE-2015-2968 LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application… vulnerability
  • CVE-2023-43297 An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. vulnerability
  • CVE-2023-26979 Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. vulnerability
  • CVE-2023-3347 A vulnerability was found in Samba's SMB2 packet signing mechanism. vulnerability
  • CVE-2023-30565 An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. vulnerability
  • CVE-2023-2885 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in… vulnerability
  • CVE-2023-22372 In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. vulnerability
  • CVE-2022-3166 Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to… vulnerability
Show all 39 ›