746
Reference Description
CVE-2020-10263 Bluetooth speaker does not require authentication for the debug functionality
on the UART port, allowing root shell access
https://www.cve.org/CVERecord?id=CVE-2020-10263
CVE-2021-23147 WiFi router does not require authentication for its UART port, allowing
adversaries with physical access to execute commands as root
https://www.cve.org/CVERecord?id=CVE-2021-23147
CVE-2021-37415 IT management product does not perform authentication for some REST API
requests, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-37415
CVE-2020-13927 Default setting in workflow management product allows all API requests
without authentication, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-13927
CVE-2002-1810 MFV. Access TFTP server without authentication and obtain configuration file
with sensitive plaintext information.
https://www.cve.org/CVERecord?id=CVE-2002-1810
CVE-2008-6827 Agent software running at privileges does not authenticate incoming requests
over an unprotected channel, allowing a Shatter" attack.
https://www.cve.org/CVERecord?id=CVE-2008-6827
CVE-2004-0213 Product enforces restrictions through a GUI but not through privileged APIs.
https://www.cve.org/CVERecord?id=CVE-2004-0213
CVE-2020-15483 monitor device allows access to physical UART debug port without
authentication
https://www.cve.org/CVERecord?id=CVE-2020-15483
CVE-2019-9201 Programmable Logic Controller (PLC) does not have an authentication feature
on its communication protocols.
https://www.cve.org/CVERecord?id=CVE-2019-9201
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 803 2010 Top 25 - Porous Defenses 800 2355
MemberOf 812 OWASP Top Ten 2010 Category A3 - Broken
Authentication and Session Management
809 2357
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 952 SFP Secondary Cluster: Missing Authentication 888 2396
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE Version 4.14
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts