Common Weakness Enumeration

CWE-422

Weakness Allowed

Unprotected Windows Messaging Channel

Abstraction: Variant · Status: Draft

The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.

Mapping guidance

This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-420 · View CWE-1000

ChildOf: CWE-360 · View CWE-1000

Modes of introduction

Architecture and Design

Notes

Relationship

Overlaps privilege errors and UI errors.

Research Gap

Possibly under-reported, probably under-studied. It is suspected that a number of publicized vulnerabilities that involve local privilege escalation on Windows systems may be related to Shatter attacks, but they are not labeled as such.

Alternate channel attacks likely exist in other operating systems and messaging models, e.g. in privileged X Windows applications, but examples are not readily available.

Content history

Submission: PLOVER · 2006-07-19 · CWE Draft 3

Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Potential_Mitigations, Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Relationships, Other_Notes, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2008-10-14 · CWE 1.0.1

updated Other_Notes, Relationship_Notes, Research_Gaps

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated References, Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Alternate_Terms, Name

4 vulnerabilities reference this CWE, most recent first.

CVE-2025-22894 (GCVE-0-2025-22894)

Vulnerability from cvelistv5 – Published: 2025-02-06 07:05 – Updated: 2025-02-12 19:41

Summary

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-06 14:15 UTC

CWE

CWE-422 - Unprotected Windows Messaging Channel ('Shatter')

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 185 records in the last 180 days details

References

2 references

URL	Tags
https://www.hummingheads.co.jp/dep/storelist/
https://jvn.jp/en/jp/JVN66673020/

Impacted products

1 product

Vendor	Product	Version
Humming Heads Inc.	Defense Platform Home Edition	Affected: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22894",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:15:19.426989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:41:05.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-422",
              "description": "Unprotected Windows Messaging Channel (\u0027Shatter\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:27.454Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-22894",
    "datePublished": "2025-02-06T07:05:27.454Z",
    "dateReserved": "2025-01-27T06:02:35.087Z",
    "dateUpdated": "2025-02-12T19:41:05.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-20094 (GCVE-0-2025-20094)

Vulnerability from cvelistv5 – Published: 2025-02-06 07:05 – Updated: 2025-02-12 19:51

Summary

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-06 14:12 UTC

CWE

CWE-422 - Unprotected Windows Messaging Channel ('Shatter')

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 185 records in the last 180 days details

References

2 references

URL	Tags
https://www.hummingheads.co.jp/dep/storelist/
https://jvn.jp/en/jp/JVN66673020/

Impacted products

1 product

Vendor	Product	Version
Humming Heads Inc.	Defense Platform Home Edition	Affected: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20094",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:12:17.311375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:10.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-422",
              "description": "Unprotected Windows Messaging Channel (\u0027Shatter\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:41.254Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-20094",
    "datePublished": "2025-02-06T07:05:41.254Z",
    "dateReserved": "2025-01-27T06:02:31.382Z",
    "dateUpdated": "2025-02-12T19:51:10.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-RC3F-G789-3FG8

Vulnerability from github – Published: 2025-02-06 09:31 – Updated: 2025-02-06 09:31

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-22894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-422"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-06T08:15:30Z",
    "severity": "MODERATE"
  },
  "details": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege.",
  "id": "GHSA-rc3f-g789-3fg8",
  "modified": "2025-02-06T09:31:46Z",
  "published": "2025-02-06T09:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22894"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN66673020"
    },
    {
      "type": "WEB",
      "url": "https://www.hummingheads.co.jp/dep/storelist"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X377-MMCG-MGM3

Vulnerability from github – Published: 2025-02-06 09:31 – Updated: 2025-02-06 09:31

Details

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-20094"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-422"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-06T08:15:29Z",
    "severity": "HIGH"
  },
  "details": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.",
  "id": "GHSA-x377-mmcg-mgm3",
  "modified": "2025-02-06T09:31:46Z",
  "published": "2025-02-06T09:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20094"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN66673020"
    },
    {
      "type": "WEB",
      "url": "https://www.hummingheads.co.jp/dep/storelist"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Architecture and Design

Always verify and authenticate the source of the message.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list