Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
Weakness
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Azure_iot_explorer | Microsoft | * | 0.15.13 (excluding) |
Extended Description
Attackers might be able to spoof the intended endpoint from a different system or process, thus gaining the same level of access as the intended endpoint. While this issue frequently involves authentication between network-based clients and servers, other types of communication channels and endpoints can have this weakness.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/161.html
- https://cwe.mitre.org/data/definitions/481.html
- https://cwe.mitre.org/data/definitions/501.html
- https://cwe.mitre.org/data/definitions/697.html