CWE-923, Improper Restriction of Communication Channel to Intended Endpoints, applies when a product opens a channel for privileged or protected operations but does not make sure it is talking to the right endpoint. It affects network services, device firmware, browser based apps and local inter-process channels.
How it happens
Attackers may spoof the intended endpoint from a different system or process and get the same access it had. MITRE says this often involves authentication between network clients and servers, but other channels and endpoints can have it too.
The observed examples show how varied it is:
- CVE-2022-30319 (details): S-bus functionality in a home automation product used an IP allowlist for access control, which a forged IP address could bypass.
- CVE-2022-22547: a troubleshooting tool exposed a web server on a random port between 9000 and 65535, useful for information gathering.
- CVE-2022-4390: a router had firewall restrictions for IPv4 but not for IPv6, which was enabled by default.
- CVE-2012-2292: a Silverlight cross-domain policy did not restrict access to another application, allowing a bypass of the Same Origin Policy.
The pattern: the check relies on something easy to fake or easy to forget, such as a source address or one protocol family.
What an attacker gains
MITRE lists integrity and confidentiality impact and the ability to gain privileges or assume identity. If the attacker spoofs the endpoint, they gain all privileges intended for the original one.
How to find it
MITRE notes SAST can find some instances by tracing data flow. Beyond that:
- Inventory every listener the product opens, on every interface and both IP versions.
- For each privileged channel, write down how the peer proves who it is.
- Treat source IP, hostname and port number as hints, not proof.
- Test the same restrictions over IPv4 and IPv6.
How to fix it
The MITRE record lists no formal mitigations. Practical steps: authenticate the peer with something it cannot forge cheaply, such as mutual TLS or signed tokens, apply the same firewall rules across all protocol versions, bind debug and troubleshooting tools to local interfaces only, and keep cross-origin policies as narrow as the feature allows.
Quick check
Why is an IP allowlist weak on its own?
Addresses can be forged, as the S-bus example shows. Use real authentication for privileged channels.
What did the router example miss?
It restricted IPv4 but left IPv6, enabled by default, unrestricted.
