CVE-2023-35906

Mandates proper device-level authentication instead of weaker identifiers such as IP addresses that are easily forged.

Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.

Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts.

Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.

Requires explicit verification of data authenticity from authoritative sources, preventing acceptance of unauthenticated resolution responses.

Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.

Time synchronization supports reliable freshness verification when checking data authenticity across systems or components.

Mandates verification of data authenticity for software, firmware, and information.

Network monitoring can detect misuse of IP authentication but does not prevent the weakness.

Managed identities and credentials supplant weak IP-based authentication decisions.

Strong authentication mechanisms directly replace reliance on spoofable IP addresses.

Authorization policies and least privilege reduce dependence on network-location assertions.

A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce, implement or prevent exploitation of IP-based authentication (a technical flaw that can still be exploited even with a policy in place).

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on whether a product trusts an IP address as an authenticator, so the weakness remains present and exploitable.

Authentication-information rules discourage reliance on mutable attributes such as IP addresses.

A.5.18 governs the provisioning, review, and revocation of access rights granted to already-authenticated identities; it has no bearing on whether an IP address is used as (or in lieu of) an authentication mechanism, so the weakness can still be present and exploited.

A.8.2 controls the allocation, review, expiry and use of privileged rights via authorization and least-privilege rules; it has no bearing on whether a product accepts an IP address as an authenticator, so the weakness can still be present and exploited.