33 vulnerabilities classified as CWE-420 (未保护的候选通道). AI Chinese analysis included.
CWE-420 represents a security weakness where an application implements robust protective measures for its primary communication channel but neglects to apply equivalent safeguards to an alternate data path. This disparity often arises when developers focus exclusively on the main interface, such as a web portal, while overlooking secondary mechanisms like background APIs, logging services, or administrative endpoints. Attackers typically exploit this oversight by bypassing the hardened primary channel to access the unprotected alternate one, thereby gaining unauthorized access to sensitive data or executing malicious commands without triggering standard security controls. To prevent this vulnerability, developers must conduct comprehensive threat modeling that identifies all potential communication paths within the system architecture. Security policies should then be uniformly applied across every channel, ensuring that encryption, authentication, and authorization mechanisms are consistently enforced regardless of the entry point used.
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;Vulnerabilities classified as CWE-420 (未保护的候选通道) represent 33 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.