CWE-923 通信信道对预期端点的不适当限制 类弱点 67 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-923属于通信通道端点验证缺陷。攻击者通过伪造或欺骗目标端点，使系统误认为正在与合法实体通信，从而绕过权限控制并获取同等访问权限。这常发生在特权操作或受保护资源的交互中。开发者应实施严格的身份验证机制，如使用数字证书、双向TLS或强签名协议，确保通信双方身份真实可信，防止中间人攻击或端点冒充。
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd"> <allow-access-from domain="*.example.com"/> <allow-access-from domain="*"/> </cross-domain-policy><?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="SOAPAction"> <domain uri="*"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-61939 | Columbia Weather Systems MicroServer 安全漏洞 — MicroServer | 8.8 | High | 2026-01-07 |
| CVE-2025-33176 | NVIDIA RunAI 安全漏洞 — RunAI | 6.2 | Medium | 2025-11-04 |
| CVE-2025-12357 | IEC ISO 15118-2 Network and Application Protocol Requirements 安全漏洞 — EV Car Chargers | 6.3 | Medium | 2025-10-31 |
| CVE-2025-49734 | Microsoft Windows PowerShell 安全漏洞 — PowerShell 7.4 | 7.0 | High | 2025-09-09 |
| CVE-2025-48807 | Microsoft Hyper-V 安全漏洞 — Windows 10 Version 1607 | 6.7 | Medium | 2025-08-12 |
| CVE-2025-35978 | Fujitsu UpdateNavi和UpdateNaviInstallService 安全漏洞 — UpdateNavi | 7.8AI | High AI | 2025-06-12 |
| CVE-2025-22251 | Fortinet FortiOS 安全漏洞 — FortiOS | 3.0 | Low | 2025-06-10 |
| CVE-2025-20261 | Cisco Integrated Management Controller 安全漏洞 — Cisco Unified Computing System (Managed) | 8.8 | High | 2025-06-04 |
| CVE-2025-48999 | DataEase 安全漏洞 — dataease | 7.5AI | High AI | 2025-06-03 |
| CVE-2025-46566 | DataEase 安全漏洞 — dataease | 8.8AI | High AI | 2025-05-01 |
| CVE-2025-23178 | Ribbon Communications Apollo 9608 安全漏洞 — Apollo 9608 | 7.6 | High | 2025-04-29 |
| CVE-2025-31144 | SIOS Technology Quick Agent 安全漏洞 — Quick Agent V3 | 9.8 | - | 2025-04-27 |
| CVE-2024-26013 | Fortinet多款产品 安全漏洞 — FortiProxy | 7.1 | High | 2025-04-08 |
| CVE-2025-29986 | Dell Common Event Enabler 安全漏洞 — Common Event Enabler | 8.3 | High | 2025-04-08 |
| CVE-2022-43916 | IBM App Connect Enterprise Certified Container 安全漏洞 — App Connect Enterprise Certified Container | 6.8 | Medium | 2025-01-30 |
| CVE-2024-22315 | IBM Storage Fusion 安全漏洞 — Fusion | 4.0 | Medium | 2025-01-28 |
| CVE-2024-47490 | Juniper Networks Junos OS Evolved 安全漏洞 — Junos OS Evolved | 8.2 | High | 2024-10-11 |
| CVE-2024-43571 | Microsoft Sudo for Windows 安全漏洞 — Windows 11 Version 24H2 | 5.6 | Medium | 2024-10-08 |
| CVE-2024-47125 | goTenna Pro 安全漏洞 — Pro | 8.1 | High | 2024-09-26 |
| CVE-2024-39537 | Juniper Networks Junos OS Evolved 安全漏洞 — Junos OS Evolved | 6.5 | Medium | 2024-07-11 |
| CVE-2024-6222 | Docker Desktop 安全漏洞 — Docker Desktop | 7.8AI | High AI | 2024-07-09 |
| CVE-2024-24974 | OpenVPN 安全漏洞 — OpenVPN 2 | 8.3AI | High AI | 2024-07-08 |
| CVE-2024-26131 | Element Android 安全漏洞 — element-android | 8.4 | High | 2024-02-20 |
| CVE-2023-28078 | Dell OS10 Networking Switches 安全漏洞 — Dell SmartFabric OS10 | 9.1 | Critical | 2024-02-15 |
| CVE-2023-44195 | Juniper Networks Junos OS Evolved 安全漏洞 — Junos OS Evolved | 5.4 | Medium | 2023-10-12 |
| CVE-2023-25518 | NVIDIA Jetson 安全漏洞 — Jetson AGX Xavier series, Jetson Xavier NX | 7.1 | High | 2023-06-23 |
| CVE-2022-38125 | Secomea SiteManager 安全漏洞 — SiteManager | 2.9 | Low | 2023-04-19 |
| CVE-2023-28971 | Juniper Networks Paragon Active Assurance 安全漏洞 — Paragon Active Assurance | 7.2 | High | 2023-04-17 |
| CVE-2023-29108 | SAP Web Dispatcher 安全漏洞 — ABAP Platform and SAP Web Dispatcher | 5.0 | Medium | 2023-04-11 |
| CVE-2022-2837 | CoreDNS 输入验证错误漏洞 — coreDNS | 6.1 | - | 2023-03-03 |
CWE-923（通信信道对预期端点的不适当限制） 是常见的弱点类别，本平台收录该类弱点关联的 67 条 CVE 漏洞。