CWE-628, Function Call with Incorrectly Specified Arguments, covers calls that pass the wrong variable, the wrong number of arguments, arguments in the wrong order, the wrong type or the wrong value. The result is always incorrect behavior, and sometimes a security hole.
How it happens
Most of these bugs show up fast, because users notice broken behavior. The dangerous ones hide in code that QA rarely exercises: error handlers, admin paths, fallback branches. Variable argument lists and format strings make the count harder to manage.
The record's example, CVE-2006-7049, is a method that called functions with the wrong argument order, letting remote attackers bypass access restrictions.
# Wrong order: the function expects (user, resource)
def can_read(user, resource): ...
if can_read(resource, user): # swapped, check is meaningless
send_file(resource)
What an attacker gains
The record lists access control impact, quality degradation and gaining privileges or assuming identity. The weakness can lead to further weaknesses that give unintended access to system resources.
How to find it
MITRE says these bugs are found quickly unless they occur in rarely tested code paths. Use code inspection tools and relevant compiler features, and pay special attention to code unlikely to be exercised heavily during QA.
How to fix it
Once found, these issues are easy to fix. Turn on compiler warnings and type checking, add tests for error and fallback paths, and make sure your APIs are stable before you use them in production code.
Quick check
Where do these bugs survive longest?
In rarely tested code paths, since normal use does not reveal the incorrect behavior.
