Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Official definition

ByMitre CWE

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Characteristics

Modes of introduction

Architecture and Design: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
Operation

Common consequences

Impact	Scope	Explanation
Gain Privileges or Assume Identity, Bypass Protection Mechanism	Access Control	—

Risk mitigations

Architecture and DesignIdentify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

CVE-2020-8004When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).View details
CVE-2002-0567DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another alternate channel), so attack can be remote.View details
CVE-2002-1578Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.View details
CVE-2003-1035User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.View details
CVE-2002-1863FTP service can not be disabled even when other access controls would require it.View details
CVE-2002-0066Windows named pipe created without authentication/access control, allowing configuration modification.View details
CVE-2004-1461Router management interface spawns a separate TCP connection after authentication, allowing hijacking by attacker coming from the same IP address.View details

Sources (2)

MITRE CWE

CWE Terms of Use

CWE-420: Unprotected Alternate Channel

What is CWE-420?

Data statistics

Vulnerabilities mapped to CWE-420

Vulnerabilities in CISA KEV for CWE-420

Official definition

Characteristics

Modes of introduction

Common consequences

Risk mitigations

Representative vulnerabilities

Run an in-depth assessment with complete web risk management