CWE-306— Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.— MITRE CWE catalog

2,405 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-306page 25 of 49

CVE-2023-49255CRITICALCVSS 9.8EG 9.8
2024-01-12
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user…
CVE-2023-49617CRITICALCVSS 10.0EG 10.0
2024-02-01
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.
CVE-2023-49693CRITICALCVSS 9.8EG 9.8
2023-11-29
NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.
CVE-2023-50199HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link G416 httpd Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link G416 routers. Authenticat…
CVE-2023-50263MEDIUMCVSS 5.3EG 3.7
2023-12-12
Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get…
CVE-2023-51062MEDIUMCVSS 5.3EG 5.3
2024-01-13
An unauthenticated log file read in the component log-smblog-save of QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 allows attackers to disclose the SMB Log contents via executing a crafted command.
CVE-2023-51478CRITICALCVSS 9.8EG 9.8
2024-04-25
Improper Authentication vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.
CVE-2023-51571HIGHCVSS 7.5EG 7.5
2024-04-01
Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower P…
CVE-2023-51587HIGHCVSS 7.5EG 7.5
2024-05-03
Voltronic Power ViewPower getModbusPassword Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower. A…
CVE-2023-51947CRITICALCVSS 9.1EG 9.1
2024-01-19
Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.
CVE-2023-51987CRITICALCVSS 9.8EG 9.8
2024-01-11
D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty passwords.
CVE-2023-5253MEDIUMCVSS 5.3EG 5.3
2024-01-15
A missing authentication check in the WebSocket channel used for the Check Point IoT integration in Nozomi Networks Guardian and CMC, may allow an unauthenticated attacker to obtain assets data without authentication. Malicious unauthen…
CVE-2023-52947MEDIUMCVSS 4.0EG 4.0
2024-09-26
Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality wil…
CVE-2023-52949MEDIUMCVSS 5.5EG 5.5
2024-09-26
Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.
CVE-2023-5376CRITICALCVSS 9.1EG 8.6
2024-01-09
An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 2024/01.
CVE-2023-53771CRITICALCVSS 9.8EG 9.8
2025-12-09
MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PA…
CVE-2023-53773MEDIUMCVSS 5.3EG 5.3
2025-12-09
MiniDVBLinux 5.4 contains an unauthenticated vulnerability in the tv_action.sh script that allows remote attackers to generate live stream snapshots through the Simple VDR Protocol. Attackers can request /tpl/tv_action.sh to create and ret…
CVE-2023-53774CRITICALCVSS 9.8EG 9.8
2025-12-09
MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to exec…
CVE-2023-53896HIGHCVSS 7.5EG 7.5
2025-12-16
D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration settings without authentication. Attackers can exploit the /cgi-bin/ExportSettings.…
CVE-2023-53964CRITICALCVSS 9.8EG 7.5
2025-12-22
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with…
CVE-2023-53967HIGHCVSS 7.5EG 7.5
2025-12-22
Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sen…
CVE-2023-53968CRITICALCVSS 9.8EG 9.8
2025-12-22
Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorize…
CVE-2023-53969HIGHCVSS 7.5EG 7.5
2025-12-22
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorize…
CVE-2023-53970HIGHCVSS 7.5EG 7.5
2025-12-22
Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API…
CVE-2023-53974HIGHCVSS 7.5EG 7.5
2025-12-22
D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuratio…
CVE-2023-54335CRITICALCVSS 9.8EG 9.8
2026-01-13
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands…
CVE-2023-54342CRITICALCVSS 9.8EG 9.8
2026-05-05
Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers c…
CVE-2023-54344CRITICALCVSS 9.8EG 9.8
2026-05-05
Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi conso…
CVE-2023-54350HIGHCVSS 7.5EG 7.5
2026-06-08
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.…
CVE-2023-54352CRITICALCVSS 9.8EG 9.8
2026-06-08
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-c…
CVE-2023-5716CRITICALCVSS 9.8EG 9.8
2024-01-19
ASUS Armoury Crate has a vulnerability in arbitrary file write and allows remote attackers to access or modify arbitrary files by sending specific HTTP requests without permission.
CVE-2023-5881HIGHCVSS 8.2EG 8.2
2024-01-03
Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modify the Garage door's SSID settings.
CVE-2023-5935HIGHCVSS 7.4EG 7.4
2024-05-15
When configuring Arc (e.g. during the first setup), a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine i…
CVE-2023-6215HIGHCVSS 7.2EG 7.2
2025-10-07
A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiali…
CVE-2023-6221HIGHCVSS 7.7EG 7.7
2024-02-01
The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against un…
CVE-2023-6368MEDIUMCVSS 5.3EG 5.9
2023-12-14
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by…
CVE-2023-6595MEDIUMCVSS 5.3EG 7.5
2023-12-14
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
CVE-2023-6718HIGHCVSS 7.5EG 9.4
2023-12-13
An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users.
CVE-2023-6942HIGHCVSS 7.5EG 7.5
2024-01-30
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Version1(GOT1000) versions 1.325P and prior, GT Designer3 Version1(GOT2000) versions 1.320J and prior…
CVE-2023-6949MEDIUMCVSS 5.2EG 5.2
2024-04-02
A Missing Authentication for Critical Function issue affecting the HTTP service running on the DJI Mavic Mini 3 Pro on the standard port 80 could allow an attacker to enumerate and download videos and pictures saved on the drone internal o…
CVE-2023-7308HIGHCVSS 7.5EG 7.5
2025-08-27
SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet.cgi endpoint. The affected component fails to enforce authentication checks on P…
CVE-2023-7325CRITICALCVSS 9.3EG 9.3
2025-10-30
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can …
CVE-2023-7328MEDIUMCVSS 5.3EG 5.3
2025-11-14
Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadat…
CVE-2023-7329HIGHCVSS 8.7EG 8.7
2025-11-12
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the d…
CVE-2024-0012CRITICALCVSS 9.8EG 9.8⚠ KEV
2024-11-18
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with t…
CVE-2024-0336CRITICALCVSS 9.4EG 9.4
2024-06-03
Missing Authentication for Critical Function vulnerability in EMTA Grup PDKS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDKS: from V3.04 before 20240603. NOTE: The vendor was contacted ear…
CVE-2024-0949CRITICALCVSS 9.8EG 9.8
2024-06-27
Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.
CVE-2024-10002HIGHCVSS 8.8EG 8.8
2024-10-22
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'rover_idx_refresh_social_callback' function. This m…
CVE-2024-10205CRITICALCVSS 9.4EG 9.4
2024-12-17
Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics component …
CVE-2024-10284CRITICALCVSS 9.8EG 9.8
2024-11-09
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21_authentication_phrase' function. This makes it possible for unauthenti…

Map vulnerabilities like CWE-306 to your infrastructure

EchelonGraph correlates every CVE — across CWE-306 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →