CWE-393: Return of Wrong Status Code
low-riskA function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
Abstraction: Base
Common Consequences
Integrity
→
Unexpected State
Detection Methods
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
Real-World Examples (6)
| CVE | CVSS | EPSS | KEV |
|---|---|---|---|
| CVE-2024-49117 | 8.8 | 0.6% | — |
| CVE-2020-5401 | 5.3 | 0.4% | — |
| CVE-2025-32414 | 5.6 | 0.2% | — |
| CVE-2023-37897 | 7.2 | 0.1% | — |
| CVE-2025-5987 | 8.1 | 0.1% | — |
| CVE-2025-24531 | 6.7 | 0.0% | — |
0
/ 100
low-risk
Active Threat
0/50 · Minimal
Exploit Availability
0/50 · Minimal