CWEweakness

CWE-657 Violation of Secure Design Principles

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product violates well-established principles for secure design.

Common consequences

• Other: Varies by Context — This can introduce resultant weaknesses or make it easier for developers to introduce related weaknesses during implementation. • Other: Reduce Maintainability — Because code is centered around design, it can be resource-intensive to fix design problems.

Observed examples

• CVE-2019-6260: Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138]. • CVE-2007-5277: The failure of connection attempts in a web browser resets DNS pin restrictions. An attacker can then bypass the same origin policy by rebinding a domain name to a different IP address. This was an attempt to "fail functional." • CVE-2006-7142: Hard-coded cryptographic key stored in executable program. • CVE-2007-0408: Server does not properly validate client certificates when reusing cached connections.

Related

Observed example · CVE (4)

  • CVE-2019-6260 The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB)… vulnerability
  • CVE-2007-5277 Microsoft Internet Explorer 6 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote… vulnerability
  • CVE-2006-7142 The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted… vulnerability
  • CVE-2007-0408 BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote… vulnerability

Child of · CWE (1)

  • CWE-710 Improper Adherence to Coding Standards weakness

Referenced by CVE · weakness (19)

  • CVE-2026-48399 Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature… vulnerability
  • CVE-2026-39888 PraisonAI is a multi-agent teams system. vulnerability
  • CVE-2025-54255 Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles… vulnerability
  • CVE-2025-24887 OpenCTI is an open-source cyber threat intelligence platform. vulnerability
  • CVE-2024-57957 Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may… vulnerability
  • CVE-2024-33849 ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. vulnerability
  • CVE-2024-26139 OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. vulnerability
  • CVE-2023-52714 Vulnerability of defects introduced in the design process in the hwnff module. vulnerability
  • CVE-2023-29320 Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Violation of Secure Design… vulnerability
  • CVE-2022-30683 Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a Violation of Secure Design Principles vulnerability that could… vulnerability
  • CVE-2022-28244 Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a violation… vulnerability
  • CVE-2021-44714 Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a Violation… vulnerability
  • CVE-2021-36061 Adobe Connect version 11.2.2 (and earlier) is affected by a secure design principles violation vulnerability via the 'pbMode' parameter. vulnerability
  • CVE-2021-28583 Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design… vulnerability
  • CVE-2020-8133 A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. vulnerability
  • CVE-2019-15611 Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when… vulnerability
  • CVE-2019-0061 The management daemon (MGD) is responsible for all configuration and management operations in Junos OS. vulnerability
  • CVE-2019-5478 A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. vulnerability
  • CVE-2017-6032 A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. vulnerability

Referenced by CWE · child of (11)

  • CWE-1192 Improper Identifier for IP Block used in System-On-Chip (SOC) weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-250 Execution with Unnecessary Privileges weakness
  • CWE-636 Not Failing Securely weakness
  • CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') weakness
  • CWE-638 Not Using Complete Mediation weakness
  • CWE-653 Improper Isolation or Compartmentalization weakness
  • CWE-654 Reliance on a Single Factor in a Security Decision weakness
  • CWE-655 Insufficient Psychological Acceptability weakness
  • CWE-656 Reliance on Security Through Obscurity weakness
  • CWE-671 Lack of Administrator Control over Security weakness

Referenced by OWASP · mapped cwe (2)