CWEweakness

CWE-447 Unimplemented or Unsupported Feature in UI

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.

Common consequences

• Other: Varies by Context, Unexpected State

Potential mitigations

• [Testing] Perform functionality testing before deploying the application.

Observed examples

• CVE-2000-0127: GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file. • CVE-2001-0863: Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass. • CVE-2001-0865: Router does not implement a specific keyword when it is used in an ACL, allowing filter bypass. • CVE-2004-0979: Web browser does not properly modify security setting when the user sets it.

Related

Observed example · CVE (4)

  • CVE-2004-0979 Internet Explorer on Windows XP does not properly modify the "Drag and Drop or copy and paste files" setting when the user sets it to… vulnerability
  • CVE-2001-0863 Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets… vulnerability
  • CVE-2001-0865 Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow… vulnerability
  • CVE-2000-0127 The Webspeed configuration program does not properly disable access to the WSMadmin utility, which allows remote attackers to gain… vulnerability

Child of · CWE (2)

  • CWE-446 UI Discrepancy for Security Feature weakness
  • CWE-671 Lack of Administrator Control over Security weakness

Referenced by CVE · weakness (3)

  • CVE-2024-0148 NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with… vulnerability
  • CVE-2024-39533 An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an… vulnerability
  • CVE-2024-21607 An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated,… vulnerability

Referenced by OWASP · mapped cwe (1)

  • A03:2025 Software Supply Chain Failures Top 10 2025