Weakness · CWE-306
Missing Authentication for Critical Function
A sensitive function requires no login at all; one of the most exploited flaws in edge devices.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-111100E3 Firmware: Kiloview E3 NDI Encoder Missing Authentication for Critical FunctionMedium 6.9
- CVE-2026-110825E3 Firmware: Kiloview E3 NDI Encoder Missing Authentication for Critical FunctionHigh 8.7
- CVE-2024-47575Fortinet FortiManager Missing Authentication VulnerabilityCritical 9.8KEV
- CVE-2026-105667dcm4chee-arc-light: J4Care dcm4che Missing Authentication for Critical FunctionHigh 8.7
- CVE-2026-107605Missing authentication for critical function in Swann Communications SWIFI-SE2KICMedium 5.9
- CVE-2026-107606Missing authentication for critical function in Swann Communications SWIFI-SE2KICMedium 6.9
- CVE-2026-107607Missing authentication for critical function in Swann Communications SWIFI-SE2KICMedium 6.9
- CVE-2026-11796Medium 5.1
- CVE-2026-33367Red Lion Controls N-Tron 700 Series Missing Authentication for Critical FunctionCritical 9.3
- CVE-2026-7395High 8.5
- CVE-2026-85479Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical FunctionMedium 6.9
- CVE-2026-105279dcm4chee-arc-light: J4Care dcm4che Missing Authentication for Critical FunctionCritical 9.3
- CVE-2026-105281Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical FunctionHigh 8.7
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- SI-4System MonitoringSystem and Information Integrity · mitigates 10 techniques
- AC-6Least PrivilegeAccess Control · mitigates 8 techniques
- AC-3Access EnforcementAccess Control · mitigates 7 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 7 techniques
- SI-7Software, Firmware, and Information IntegritySystem and Information Integrity · mitigates 6 techniques
- AC-2Account ManagementAccess Control · mitigates 5 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 5 techniques
- CM-8System Component InventoryConfiguration Management · mitigates 5 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 5 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.