CWE-628: Function Call with Incorrectly Specified Arguments

Extended Description

There are multiple ways in which this weakness can be introduced, including: the wrong variable or reference; an incorrect number of arguments; incorrect order of arguments; wrong type of arguments; or wrong value.

Code Examples & CVEs

Demonstrative Examples

The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.

BadPHP

function authenticate($username, $password) {                                                                                 // authenticate user                            ...                      }                      authenticate($_POST['password'], $_POST['username']);

This Perl code intends to record whether a user authenticated successfully or not, and to exit if the user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0 instead of 1, so it does not exit.

BadPerl

sub ReportAuth {my ($username, $result, $fatal) = @_;PrintLog("auth: username=%s, result=%d", $username, $result);if (($result ne "success") && $fatal) {die "Failed!\n";}}                      sub PrivilegedFunc{my $result = CheckAuth($username);ReportAuth($username, $result, 0);DoReallyImportantStuff();}

In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.

BadJava

private static final String[] ADMIN_ROLES = ...;public boolean void accessGranted(String resource, String user) {String[] userRoles = getUserRoles(user);return accessGranted(resource, ADMIN_ROLES);}                      private boolean void accessGranted(String resource, String[] userRoles) {                                                                                 // grant or deny access based on user roles                            ...                      }

Observed CVE Examples (1)

CVE-2006-7049

The method calls the functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-628 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-628, Function Call with Incorrectly Specified Arguments, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Function Call with Incorrectly Specified Arguments during Build and Compilation

MITRE associates mitigation with Build and Compilation, and Architecture and Design; documented detection approaches include Other; recorded impacts include Quality Degradation, and Gain Privileges or Assume Identity. Use these source-defined anchors to turn CWE-628 into implementation, review, and verification checks for the affected component.

CWE-628: Function Call with Incorrectly Specified Arguments — MITRE CWE

Triage CWE-628 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-628, Function Call with Incorrectly Specified Arguments, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-628

Apply MITRE's full root-cause mapping guidance when using CWE-628, Function Call with Incorrectly Specified Arguments. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-628 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-628, Function Call with Incorrectly Specified Arguments. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-628: Function Call with Incorrectly Specified Arguments?+

CWE-628: Function Call with Incorrectly Specified Arguments is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses. There are multiple ways in which this weakness can be introduced, including: the wrong variable or reference; an incorrect number of arguments; incorrect order of arguments; wrong type of arguments; or wrong value.

What are the security consequences of Function Call with Incorrectly Specified Arguments?+

If exploited, CWE-628 (Function Call with Incorrectly Specified Arguments) it can compromise Other and Access Control, leading to outcomes such as Quality Degradation and Gain Privileges or Assume Identity.

How do you prevent or mitigate Function Call with Incorrectly Specified Arguments?+

Recommended mitigations for CWE-628 include: Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA. Make sure your API's are stable before you use them in production code.

How is Function Call with Incorrectly Specified Arguments detected?+

CWE-628 can be detected using Other. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Function Call with Incorrectly Specified Arguments?+

CWE-628 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Function Call with Incorrectly Specified Arguments?+

MITRE documents real CVEs mapped to CWE-628, including CVE-2006-7049. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-628 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-628: Function Call with Incorrectly Specified Arguments

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Detection Methods

Method

Description

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (1)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-628 with SSDF evidence

Address Function Call with Incorrectly Specified Arguments during Build and Compilation

Triage CWE-628 against known exploitation evidence

Apply precise root-cause mapping to CWE-628

Validate CWE-628 with root-cause mapping checks

Frequently Asked Questions

Learn More