CWE-290 使用欺骗进行的认证绕过 类弱点 315 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-290 是一种身份验证绕过漏洞，源于身份验证机制实现不当，易受欺骗攻击。攻击者通常通过伪造或篡改身份标识（如IP地址、证书或令牌），使系统误认其为合法用户从而获取未授权访问权限。开发者应实施强身份验证策略，包括多因素认证、严格的输入验证及防重放机制，并定期审查认证逻辑，确保身份源的可信性与完整性，以有效防御此类欺骗行为。
String sourceIP = request.getRemoteAddr(); if (sourceIP != null && sourceIP.equals(APPROVED_IP)) { authenticated = true; }sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET; serv.sin_addr.s_addr = htonl(INADDR_ANY); servr.sin_port = htons(1008); bind(sd, (struct sockaddr *) & serv, sizeof(serv)); while (1) { memset(msg, 0x0, MAX_MSG); clilen = sizeof(cli); if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) { n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen); } }while(true) { DatagramPacket rp=new DatagramPacket(rData,rData.length); outSock.receive(rp); String in = new String(p.getData(),0, rp.getLength()); InetAddress clientIPAddress = rp.getAddress(); int port = rp.getPort(); if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) { out = secret.getBytes(); DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp); } }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-36754 | Growatt ShineLan-X 安全漏洞 — ShineLan-X | 7.4AI | HighAI | 2025-12-13 |
| CVE-2025-36753 | Growatt ShineLan-X 安全漏洞 — ShineLan-X | 9.1AI | CriticalAI | 2025-12-13 |
| CVE-2024-8273 | HYPR Server 安全漏洞 — Server | 7.5AI | HighAI | 2025-12-11 |
| CVE-2025-13953 | GTT Sistema de Información Tributario 安全漏洞 — Sistema de Información Tributario | 7.8AI | HighAI | 2025-12-10 |
| CVE-2025-66508 | 1Panel 安全漏洞 — 1Panel | 6.5 | Medium | 2025-12-09 |
| CVE-2025-66570 | cpp-httplib 安全漏洞 — cpp-httplib | 10.0 | Critical | 2025-12-05 |
| CVE-2025-27389 | OPPO ColorOS 安全漏洞 — ColorOS | 8.1 | - | 2025-12-05 |
| CVE-2025-66270 | KDE Connect 安全漏洞 — KDE Connect protocol | 4.7 | Medium | 2025-12-05 |
| CVE-2025-12653 | GitLab CE/EE 安全漏洞 — GitLab | 6.5 | Medium | 2025-11-26 |
| CVE-2025-12414 | Google Looker 安全漏洞 — Looker | 7.4 | - | 2025-11-20 |
| CVE-2025-58595 | WordPress plugin All In One Login 安全漏洞 — All In One Login | 5.3 | Medium | 2025-11-06 |
| CVE-2025-59501 | Microsoft Configuration Manager 安全漏洞 — Microsoft Configuration Manager | 4.8 | Medium | 2025-10-31 |
| CVE-2025-11843 | Therefore Online和Therefore On-Premises 安全漏洞 — Therefore Online and Therefore On-Premises | 6.5 | - | 2025-10-31 |
| CVE-2025-61778 | Akka.NET 访问控制错误漏洞 — akka.net | 9.1AI | CriticalAI | 2025-10-06 |
| CVE-2025-54288 | LXD 安全漏洞 — LXD | 5.1AI | MediumAI | 2025-10-02 |
| CVE-2025-59154 | Openfire 安全漏洞 — Openfire | 5.9 | Medium | 2025-09-15 |
| CVE-2025-7448 | Silicon Labs Wi-SUN Stack 安全漏洞 — Wi-SUN Stack | 5.9 | - | 2025-09-12 |
| CVE-2025-8853 | 2100 TECHNOLOGY Electronic Official Document Management System 安全漏洞 — Official Document Management System | 9.8 | Critical | 2025-08-11 |
| CVE-2025-36119 | IBM i 安全漏洞 — i | 7.1 | High | 2025-08-08 |
| CVE-2025-36594 | Dell PowerProtect Data Domain 安全漏洞 — PowerProtect Data Domain Feature Release | 9.8 | Critical | 2025-08-04 |
| CVE-2025-54576 | OAuth2-Proxy 安全漏洞 — oauth2-proxy | 9.1 | Critical | 2025-07-30 |
| CVE-2025-34063 | One Identity OneLogin AD Connector 安全漏洞 — OneLogin Active Directory Connector (ADC) | 8.8AI | HighAI | 2025-07-01 |
| CVE-2025-34065 | AVTECH IP camera、AVTECH DVR和AVTECH NVR 安全漏洞 — IP camera, DVR, and NVR Devices | 9.8AI | CriticalAI | 2025-07-01 |
| CVE-2025-34053 | AVTECH IP camera、AVTECH DVR和AVTECH NVR 安全漏洞 — IP camera, DVR, and NVR devices | 9.8AI | CriticalAI | 2025-07-01 |
| CVE-2025-48937 | matrix-rust-sdk 安全漏洞 — matrix-rust-sdk | 4.9 | Medium | 2025-06-10 |
| CVE-2025-49004 | caido 安全漏洞 — caido | 7.5 | High | 2025-06-09 |
| CVE-2025-48906 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 8.8 | High | 2025-06-06 |
| CVE-2025-49002 | DataEase 安全漏洞 — dataease | 8.2AI | HighAI | 2025-06-03 |
| CVE-2025-48027 | pGina 安全漏洞 — pGina.Fork | 5.4 | Medium | 2025-05-15 |
| CVE-2025-27695 | Dell Wyse Management Suite 安全漏洞 — Wyse Management Suite | 4.9 | Medium | 2025-05-08 |
CWE-290（使用欺骗进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 315 条 CVE 漏洞。