On this page
CWE-287: Improper Authentication
Weakness Summary
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- Canonical source: MITRE CWE-287 (opens in a new tab)
- Published Atomicorp CVE observations: 75
- Distinct affected products in those observations: 71
- Active Atomicorp rules associated with this weakness: 86
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2010-4279 | Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability | pandora fms | Protected by Atomicorp rules | 390700 |
| CVE-2013-1080 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | Protected by Atomicorp rules | 330791 , 340006 , 340152 , 390719 |
| CVE-2025-55169 | WeGIA - Directory Traversal | wegia | Protected by Atomicorp rules | 340007 , 344360 |
| CVE-2026-41679 | Paperclip AI RCE using a chain of six API calls (CVE-2026-41679). | paperclipai | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilter | kestra | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2012-6710 | eXtplorer v2.1 Arbitrary File Upload Vulnerability | extplorer | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390700 , 390801 |
| CVE-2013-2681 | Cisco Linksys E4200 - Multiple Vulnerabilities | linksys e4200 firmware | Protected by Atomicorp rules | 392301 |
| CVE-2013-7137 | Burden 1.8 - Authentication Bypass | burden | Protected by Atomicorp rules | 390727 , 392301 , 392648 |
| CVE-2015-1187 | D-Link/TRENDnet NCC Service Command Injection | dir-626l firmware | Protected by Atomicorp rules | 344363 , 344364 , 393655 |
| CVE-2015-6922 | Kaseya VSA uploader.aspx Arbitrary File Upload | virtual system administrator | Protected by Atomicorp rules | 340128 , 344365 , 360152 , 380018 , 390801 |
| CVE-2017-12478 | Unitrends UEB http api remote code execution | unitrends backup | Protected by Atomicorp rules | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2017-14706 | DenyAll Web Application Firewall Remote Code Execution | i-suite | Protected by Atomicorp rules | 344364 , 393655 |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801 |
| CVE-2018-17153 | Western Digital MyCloud unauthenticated command injection | my cloud wdbctl0020hwt firmware | Protected by Atomicorp rules | 344363 |
| CVE-2018-17431 | Comodo Unified Threat Management Web Console - Remote Code Execution | unified threat management firewall | Protected by Atomicorp rules | 344361 , 344362 , 344364 , 390722 |
| CVE-2018-3810 | Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass | smart google code inserter | Protected by Atomicorp rules | 380026 |
| CVE-2018-6328 | Unitrends UEB http api remote code execution | unitrends backup | Protected by Atomicorp rules | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2019-13372 | D-Link Central WiFi Manager CWM(100) RCE | central wifimanager | Protected by Atomicorp rules | 340011 , 344370 |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | Protected by Atomicorp rules | 344361 , 344362 , 344363 , 344370 , 345493 , 350147 , 360151 , 390724 , 390727 , 392301 , 392648 |
| CVE-2020-25592 | SaltStack Salt REST API Arbitrary Command Execution | salt | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | Protected by Atomicorp rules | 330791 , 334168 , 340006 , 340007 , 340128 , 340152 , 344360 , 347009 , 360152 , 380018 , 390709 , 390719 , 390801 , 391213 |
| CVE-2020-8771 | WordPress Time Capsule < 1.21.16 - Authentication Bypass | wp time capsule | Protected by Atomicorp rules | 392301 |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | Protected by Atomicorp rules | 330791 , 334168 , 340014 , 340128 , 340149 , 340152 , 344364 , 344366 , 344370 , 350147 , 360152 , 380018 , 390801 |
| CVE-2021-24527 | Profile Builder < 3.4.9 - Improper Authentication | profile builder | Protected by Atomicorp rules | 340130 |
| CVE-2021-25281 | SaltStack Salt API Unauthenticated RCE through wheel_async client | salt | Protected by Atomicorp rules | 340007 , 340029 , 344360 , 344364 , 344370 , 390709 |
| CVE-2022-22956 | VMware Workspace ONE Access VMSA-2022-0011 exploit chain | identity manager | Protected by Atomicorp rules | 392647 |
| CVE-2023-30869 | Easy Digital Downloads - Privilege Escalation | easy digital downloads | Detected by Atomicorp rules | 377360 |
| CVE-2023-34124 | Sonicwall | analytics | Protected by Atomicorp rules | 340017 , 340145 , 340156 , 341145 , 341245 , 344361 , 344362 , 344363 , 344364 , 344365 , 344366 , 360148 , 380123 , 393655 |
| CVE-2023-38096 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | Protected by Atomicorp rules | 334168 , 340156 , 390700 |
| CVE-2023-50919 | GL.iNet Unauthenticated Remote Command Execution via the logread module. | gl-ax1800 firmware | Protected by Atomicorp rules | 341245 , 391213 |
| CVE-2023-6329 | Control iD iDSecure Authentication Bypass (CVE-2023-6329) | idsecure | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2024-0799 | Arcserve Unified Data Protection - Authentication Bypass | udp | Protected by Atomicorp rules | 391213 |
| CVE-2024-28255 | OpenMetadata authentication bypass and SpEL injection exploit chain | openmetadata | Protected by Atomicorp rules | 337209 , 337211 , 340087 |
| CVE-2024-7593 | Ivanti vTM - Authentication Bypass | virtual traffic manager | Protected by Atomicorp rules | 392301 |
| CVE-2025-61882 | Oracle E-Business Suite CVE-2025-61882 RCE | concurrent processing | Protected by Atomicorp rules | 340007 , 340029 , 341256 , 342259 , 344360 , 344370 , 390709 , 391213 |
| CVE-2026-11387 | SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation | sms-alert | Detected by Atomicorp rules | 377360 |
| CVE-2026-48114 | Metacat has an unauthenticated SQL injection vulnerability | metacat | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-48528 | Metacat has an unauthenticated SQL injection vulnerability | metacat | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82329 | JFrog Artifactory Access Blank Join Key Authentication Bypass | artifactory | Protected by Atomicorp rules | 300022 |
| CVE-2025-66039 | FreePBX firmware file upload | freepbx | Protected by Atomicorp rules | 340006 , 340145 , 340156 , 344360 , 390719 |
| CVE-2026-16232 | Check Point SmartConsole Authentication Bypass Run Script RCE | multi-domain security management | Protected by Atomicorp rules | 344361 , 344363 |
| CVE-2013-4863 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | Protected by Atomicorp rules | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2018-12613 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | Protected by Atomicorp rules | 340007 , 340087 , 344360 , 347009 , 390709 , 390728 , 390801 |
| CVE-2018-1418 | IBM QRadar SIEM Unauthenticated Remote Code Execution | qradar security information and event manager | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2018-7358 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | Protected by Atomicorp rules | 330791 , 334168 , 340152 |
| CVE-2020-24579 | D-Link DSL 2888a - Authentication Bypass/Remote Command Execution | dsl2888a firmware | Protected by Atomicorp rules | 344360 , 347009 , 390904 , 392301 |
| CVE-2022-41678 | Apache ActiveMQ Jolokia Authenticated Remote Code Execution (CVE-2022-41678) | activemq | Protected by Atomicorp rules | 330925 |
| CVE-2023-4415 | Ruijie RG-EW1200G Router Background - Login Bypass | rg-ew1200g firmware | Protected by Atomicorp rules | 392301 |
| CVE-2023-46805 | Ivanti Connect Secure Unauthenticated Remote Code Execution | connect secure | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2018-12455 | Intelbras NPLUG 1.0.0.14 - Authentication Bypass | nplug | Protected by Atomicorp rules | 390716 |
| CVE-2021-45841 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | Protected by Atomicorp rules | 340006 , 340007 , 340029 , 344360 , 344364 , 347009 , 390709 , 390719 |
| CVE-2014-8424 | Arris VAP2500 tools_command.php Command Execution | vap2500 firmware | Protected by Atomicorp rules | 344363 |
| CVE-2025-27621 | UpTrain has a Constant Default API Key | uptrain | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2009-1122 | MS09-020 IIS6 WebDAV Unicode Authentication Bypass | internet information services | Protected by Atomicorp rules | 398110 |
| CVE-2009-1535 | MS09-020 IIS6 WebDAV Unicode Authentication Bypass | internet information services | Protected by Atomicorp rules | 398110 |
| CVE-2013-0209 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | movable type | Protected by Atomicorp rules | 340128 , 380018 , 390801 |
| CVE-2013-1391 | Multiple DVR Manufacturers Configuration Disclosure | dvr-04ch firmware | Protected by Atomicorp rules | 390716 |
| CVE-2013-4824 | HP Intelligent Management SOM Account Creation | imc service operation management software module | Protected by Atomicorp rules | 391213 |
| CVE-2014-4725 | Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload | mailpoet newsletters | Protected by Atomicorp rules | 330791 , 340152 , 382238 |
| CVE-2015-1486 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 , 392301 |
| CVE-2015-6401 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | Protected by Atomicorp rules | 333141 , 340147 , 340148 , 340149 , 341256 , 342259 , 344363 , 346755 , 350148 , 390726 , 392301 , 392647 , 392648 |
| CVE-2018-19458 | PHP Proxy 3.0.3 - Local File Inclusion | php-proxy | Protected by Atomicorp rules | 340162 , 340165 , 344360 , 347009 |
| CVE-2022-30995 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | Protected by Atomicorp rules | 340011 , 340128 , 380018 , 390801 |
| CVE-2023-0905 | Employee Task Management System v1.0 - Broken Authentication | employee task management system | Protected by Atomicorp rules | 344365 , 344370 , 345493 , 350147 |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82988 | vCast Improper Authentication Vulnerability | vCast | Protected by Atomicorp rules | 351000 |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | Protected by Atomicorp rules | 340003 , 340147 , 340148 , 340156 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 , 390727 , 392301 , 392648 |
| CVE-2021-39165 | Cachet <=2.3.18 - SQL Injection | cachet | Protected by Atomicorp rules | 340145 , 340156 , 341145 , 380026 , 380122 |
| CVE-2025-32815 | NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials | netmri | Protected by Atomicorp rules | 344360 , 390709 , 390722 |
| CVE-2025-49706 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint enterprise server | Protected by Atomicorp rules | 330906 , 344361 , 344363 , 350147 |
| CVE-2025-53771 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | sharepoint server | Protected by Atomicorp rules | 330906 , 344361 , 344363 , 350147 |
| CVE-2022-28666 | Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update | custom product tabs for woocommerce | Protected by Atomicorp rules | 392301 |
| CVE-2012-2983 | Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access | webmin | Protected by Atomicorp rules | 340006 , 340007 , 344360 , 347009 , 390709 |
| CVE-2018-11770 | Apache Spark Unauthenticated Command Execution | spark | Protected by Atomicorp rules | 330791 , 340152 , 340162 , 340163 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 300022 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 330906 | Active | disruptive (deny) |
| 330925 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 337209 | Active | disruptive (deny) |
| 337211 | Active | disruptive (deny) |
| 340003 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340011 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340121 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340130 | Active | disruptive (deny) |
| 340144 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340149 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 341145 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 341266 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344365 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 345493 | Active | non-disruptive (pass) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 351000 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360151 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380018 | Active | disruptive (deny) |
| 380026 | Active | disruptive (deny) |
| 380122 | Active | disruptive (deny) |
| 380123 | Active | disruptive (deny) |
| 382238 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390636 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 390724 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390727 | Active | disruptive (deny) |
| 390728 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 390904 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
| 398110 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-114 (opens in a new tab) , CAPEC-115 (opens in a new tab) , CAPEC-151 (opens in a new tab) , CAPEC-194 (opens in a new tab) , CAPEC-22 (opens in a new tab) , CAPEC-57 (opens in a new tab) , CAPEC-593 (opens in a new tab) , CAPEC-633 (opens in a new tab) , CAPEC-650 (opens in a new tab) , CAPEC-94 (opens in a new tab)