Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Official definition

ByMitre CWE

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Characteristics

Modes of introduction

Architecture and Design: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
Operation

Common consequences

Impact	Scope	Explanation
Gain Privileges or Assume Identity, Bypass Protection Mechanism	Access Control	-

Risk mitigations

Architecture and DesignIdentify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

CVE-2020-8004-When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
CVE-2002-0567-DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another alternate channel), so attack can be remote.
CVE-2002-1578-Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.
CVE-2003-1035-User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.
CVE-2002-1863-FTP service can not be disabled even when other access controls would require it.
CVE-2002-0066-Windows named pipe created without authentication/access control, allowing configuration modification.
CVE-2004-1461-Router management interface spawns a separate TCP connection after authentication, allowing hijacking by attacker coming from the same IP address.

Sources (2)

MITRE CWE

CWE Terms of Use

CWE-420: Unprotected Alternate Channel

What is CWE-420?

Vulnerabilities mapped to CWE-420

No data

Official definition

Characteristics

Modes of introduction

Common consequences

Risk mitigations

Representative vulnerabilities

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Cybersecurity knowledge