CWE-940 通信信道源的不正确验证 类弱点 48 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-940属于通信源验证缺陷漏洞。攻击者通过建立来自不可信来源的通信通道，绕过身份验证机制，从而获取未授权访问权限或执行特权操作。开发者应在处理传入请求时，严格校验通信通道的来源，确保其符合预期信任域，并实施来源白名单或签名验证，以防止恶意实体伪造请求入口，保障系统交互的安全性。
IntentFilter filter = new IntentFilter("com.example.RemoveUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); public class DeleteReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { int userID = intent.getIntExtra("userID"); destroyUserData(userID); } }// Android @Override public boolean shouldOverrideUrlLoading(WebView view, String url){ if (url.substring(0,14).equalsIgnoreCase("examplescheme:")){ if(url.substring(14,25).equalsIgnoreCase("getUserInfo")){ writeDataToView(view, UserData); return false; } else{ return true; } } }// iOS -(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType { NSURL *URL = [exRequest URL]; if ([[URL scheme] isEqualToString:@"exampleScheme"]) { NSString *functionString = [URL resourceSpecifier]; if ([functionString hasPrefix:@"specialFunction"]) { // Make data available back in webview. UIWebView *webView = [self writeDataToView:[URL query]]; } return NO; } return YES; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-25305 | Home Assistant 安全漏洞 — core | 7.0 | High | 2025-02-18 |
| CVE-2025-23222 | dde-api-proxy 安全漏洞 — dde-api-proxy | 8.4 | High | 2025-01-24 |
| CVE-2024-7322 | Silicon Labs EmberZNet 访问控制错误漏洞 — EmberZNet | 5.8 | Medium | 2025-01-15 |
| CVE-2024-36506 | Fortinet FortiClientEMS 安全漏洞 — FortiClientEMS | 3.5 | Low | 2025-01-14 |
| CVE-2025-23018 | IPv6-in-IPv4 tunneling 安全漏洞 — IPv6 | 5.4 | Medium | 2025-01-14 |
| CVE-2025-23019 | IPv6-in-IPv4 tunneling 安全漏洞 — IPv6 | 5.4 | Medium | 2025-01-14 |
| CVE-2024-49579 | JetBrains YouTrack 安全漏洞 — YouTrack | 8.1 | High | 2024-10-17 |
| CVE-2024-20390 | Cisco IOS XR 安全漏洞 — Cisco IOS XR Software | 5.3 | Medium | 2024-09-11 |
| CVE-2024-1621 | NT-ware uniFLOW Online 安全漏洞 — uniFLOW Online | 9.8AI | Critical AI | 2024-09-02 |
| CVE-2024-0009 | Palo Alto Networks PAN-OS 安全漏洞 — PAN-OS | 6.3 | Medium | 2024-02-14 |
| CVE-2023-51440 | Siemens SIMATIC 安全漏洞 — SIMATIC CP 343-1 | 7.5 | High | 2024-02-13 |
| CVE-2023-48387 | TAIWAN-CA(TWCA) JCICSecurityTool 跨站脚本漏洞 — JCICSecurityTool | 8.8 | High | 2023-12-15 |
| CVE-2023-41355 | Nokia G-040W-Q 安全漏洞 — NOKIA G-040W-Q | 9.8 | Critical | 2023-11-03 |
| CVE-2023-41094 | Silicon Labs EmberZNet 安全漏洞 — Ember ZNet | 10.0 | Critical | 2023-10-04 |
| CVE-2023-3663 | CODESYS Development System 数据伪造问题漏洞 — CODESYS Development System | 8.8 | High | 2023-08-03 |
| CVE-2022-4848 | memos 安全漏洞 — usememos/memos | 6.5 | - | 2022-12-29 |
| CVE-2022-4800 | memos 安全漏洞 — usememos/memos | 6.5 | - | 2022-12-28 |
| CVE-2021-41038 | Eclipse Theia 安全漏洞 — @theia/plugin-ext | 6.1 | - | 2021-11-10 |
CWE-940（通信信道源的不正确验证） 是常见的弱点类别，本平台收录该类弱点关联的 48 条 CVE 漏洞。