The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
Volume of CVEs assigned to CWE-419 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11248HIGH The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpo | Aug 29, 2019 | 8.2 | 72 | NO | YES |
CVE-2023-30859CRITICAL Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit | May 1, 2023 | 9.8 | 31 | NO | NO |
CVE-2024-50588CRITICAL An unauthenticated attacker with access to the local network of the
medical office can use known default credentials to gain remote DBA
access to the Elefant Firebird database. T | Nov 8, 2024 | 9.8 | 30 | NO | NO |
CVE-2018-12120HIGH Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens | Nov 28, 2018 | 8.1 | 28 | NO | NO |
CVE-2018-12539HIGH In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach A | Aug 14, 2018 | 7.8 | 25 | NO | NO |
CVE-2024-2414HIGH The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a sh | Mar 13, 2024 | 8.8 | 24 | NO | NO |
CVE-2025-24030HIGH Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a pat | Jan 23, 2025 | 7.1 | 21 | NO | NO |
CVE-2024-3051HIGH Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway d | Apr 26, 2024 | 7.5 | 20 | NO | NO |
CVE-2023-6533MEDIUM Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by | Feb 21, 2024 | 6.5 | 20 | NO | NO |
CVE-2022-33932MEDIUM Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vulnerability. An unauthenticated network | Aug 22, 2022 | 5.3 | 19 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.