CWE：CWE-1390 Weak Authentication（弱认证） 英文：The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct. 译文：该产品使用一种认证机制来限制对特定用户或身份的访问，但该机制未能充分证明所声称的身份是正确的。 Attackers may be able to bypass weak authentication faster and/or with less effort than expected. 译文：攻击者可能能够比预期更快地和/或更轻松地绕过弱认证。
常见影响 (1)
Integrity, Confidentiality, Availability, Access ControlRead Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
代码示例 (1)
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…