Unprotected Primary Channel
CWE-419
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6.
How this weakness is prevented
- Architecture and Design: Do not expose administrative functionality on the user UI.
- Architecture and Design: Protect the administrative/restricted functionality with a strong authentication mechanism.
Latest Unprotected Primary Channel vulnerabilities
- 7.1 High severity
gateway: Unprotected Primary Channel
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed
- 9.8 Critical severity
Elefant: Unprotected Primary Channel
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other se
- 7.5 High severity
Z/IP Gateway SDK: Uncaught Exception
Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.
- 8.8 High severity
Router Movistar 4G: Unprotected Primary Channel
The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges.
- 9.8 Critical severity
Triton: Unprotected Primary Channel
Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bri