The product uses an IP address for authentication.
IP addresses can be easily spoofed. Attackers can forge the source IP address of the packets they send, but response packets will return to the forged IP address. To see the response packets, the attacker has to sniff the traffic between the victim machine and the forged IP address. In order to accomplish the required sniffing, attackers typically attempt to locate themselves on the same subnet as the victim machine. Attackers may be able to circumvent this requirement by using source routing, but source routing is disabled across much of the Internet today. In summary, IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication.

Resultant

Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

High

Access Control
Non-Repudiation
Hide Activities
Gain Privileges or Assume Identity
Malicious users can fake authentication information, impersonating any IP address.

Architecture and Design
Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.

Both of these examples check if a request is from a trusted address before responding to the request.

sd = socket(AF_INET, SOCK_DGRAM, 0);serv.sin_family = AF_INET;serv.sin_addr.s_addr = htonl(INADDR_ANY);servr.sin_port = htons(1008);bind(sd, (struct sockaddr *) & serv, sizeof(serv));
while (1) {memset(msg, 0x0, MAX_MSG);clilen = sizeof(cli);if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) {n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);}}

while(true) {
DatagramPacket rp=new DatagramPacket(rData,rData.length);outSock.receive(rp);String in = new String(p.getData(),0, rp.getLength());InetAddress clientIPAddress = rp.getAddress();int port = rp.getPort();
if (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) {out = secret.getBytes();DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp);}
}

The code only verifies the address as stored in the request packet. An attacker can spoof this address, thus impersonating a trusted client.

CVE-2022-30319
S-bus functionality in a home automation product performs access control using an IP allowlist, which can be bypassed by a forged IP address.
https://www.cve.org/CVERecord?id=CVE-2022-30319

Trusting self-reported IP address

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2010-02-16
updated Description, Other_Notes

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Demonstrative_Examples

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2013-06-23
Critical
Changed type from composite to weakness.

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Description, Name, Relationships, Type

CWE Content Team
MITRE
2014-02-18
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Causal_Nature, Demonstrative_Examples, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated References, Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples, References

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships

Trusting Self-reported IP Address