CWE-1327 is the weakness of assigning the address 0.0.0.0 to a database server, cloud instance or any resource that talks over the network. Developers, platform engineers and anyone who ships containers should know it.
How it happens
A server bound to 0.0.0.0 accepts connections from every IP address on the machine, so it is reachable from every network the host is attached to. MITRE points out this may be far broader than the developer or administrator wanted, who might expect it to be reachable only from one interface or network.
A local development dashboard is the typical case. It was meant for the laptop, but it listens to the whole network.
# Vulnerable: reachable from every network interface
app.run(host="0.0.0.0", port=8080)
# Safer: loopback only, unless you really need remote access
app.run(host="127.0.0.1", port=8080)
If remote access is required, bind to the specific interface address and add authentication and a firewall rule.
The record lists two CVEs:
- CVE-2023-41742: a cybersecurity product binds to an unrestricted IP address.
- CVE-2022-21947: a desktop manager for Kubernetes and container management binds a service to 0.0.0.0, letting users on the network make requests to a dashboard API.
What an attacker gains
The consequence listed is availability, with denial of service amplification. In practice, exposure to a wider network also gives attackers access to whatever the service offers, so the severity depends on that service.
How to find it
The record has no detection methods. Easy checks:
- Search configuration and code for 0.0.0.0 and for wildcard listen settings.
- Run a listening port report on a host, for example with ss or netstat, and read the local address column.
- In container images, check what the entrypoint binds to and what ports are published.
How to fix it
- Assign addresses other than 0.0.0.0. MITRE rates this high.
- Use a firewall or other packet filtering to deny unwanted connections to the server. Also rated high.
Container note: a process inside a container often must listen on 0.0.0.0 to be reachable through a published port. In that case limit exposure where you publish the port, for example by mapping to the host loopback address only.
Quick check
Does binding to 127.0.0.1 make a service safe?
It limits network exposure to the local machine, which removes this weakness. The service still needs its own authentication for local threats.
