Improper Access Control
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-284: Improper Access Control |
| OWASP | A05:2017 - Broken Access Control |
| Confidence Level | Low |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
Enabling ‘serial-port-enable’ on a Google Compute Engine VM allows connections to the VM’s serial port, which can expose sensitive system access if not properly restricted. This setting should be disabled unless explicitly required for debugging or troubleshooting.
Impact#
If attackers gain access to the serial port, they could potentially bypass standard authentication, view sensitive console output, or execute commands directly on the VM. This increases the risk of unauthorized access and compromise of the virtual machine and its data.