CWEweakness

CWE-684 Incorrect Provision of Specified Functionality

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The code does not function according to its published specifications, potentially leading to incorrect usage.

Common consequences

• Other: Quality Degradation, Unexpected State, Varies by Context — When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.

Potential mitigations

• [Implementation] Ensure that your code strictly conforms to specifications.

Observed examples

• CVE-2002-1446: Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages. • CVE-2001-1559: Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476). • CVE-2003-0187: Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations. • CVE-1999-1446: UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.

Related

Observed example · CVE (4)

  • CVE-2003-0187 The connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows… vulnerability
  • CVE-2002-1446 The error checking routine used for the C_Verify call on a symmetric verification key in the nCipher PKCS#11 library 1.2.0 and later… vulnerability
  • CVE-2001-1559 The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the… vulnerability
  • CVE-1999-1446 Internet Explorer 3 records a history of all URL's that are visited by a user in DAT files located in the Temporary Internet Files and… vulnerability

Child of · CWE (1)

  • CWE-710 Improper Adherence to Coding Standards weakness

Referenced by CVE · weakness (31)

  • CVE-2026-106361 Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker… vulnerability
  • CVE-2026-106390 Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak… vulnerability
  • CVE-2026-79126 Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker… vulnerability
  • CVE-2026-52735 ZEBRA is a Zcash node written entirely in Rust. vulnerability
  • CVE-2026-44597 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. vulnerability
  • CVE-2026-40684 In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is… vulnerability
  • CVE-2026-40685 In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in… vulnerability
  • CVE-2026-42255 Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation. vulnerability
  • CVE-2026-35379 A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. vulnerability
  • CVE-2026-35381 A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z… vulnerability
  • CVE-2026-34478 Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through… vulnerability
  • CVE-2026-30791 Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux,… vulnerability
  • CVE-2026-3598 Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows,… vulnerability
  • CVE-2025-66384 app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name. vulnerability
  • CVE-2025-55174 In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the… vulnerability
  • CVE-2025-58325 An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10,… vulnerability
  • CVE-2025-54567 hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. vulnerability
  • CVE-2025-54568 Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured… vulnerability
  • CVE-2025-47227 In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is… vulnerability
  • CVE-2024-50357 FutureNet NXR series routers provided by Century Systems Co., Ltd. vulnerability
  • CVE-2024-5005 An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from… vulnerability
  • CVE-2024-8974 Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in… vulnerability
  • CVE-2024-20317 A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS)… vulnerability
  • CVE-2024-6502 An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and… vulnerability
  • CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. vulnerability
  • CVE-2023-5363 Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. vulnerability
  • CVE-2023-4258 In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be… vulnerability
  • CVE-2023-5158 A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. vulnerability
  • CVE-2023-24845 A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM… vulnerability
  • CVE-2022-23728 Attacker can reset the device with AT Command in the process of rebooting the device. vulnerability
Show all 31 ›

Referenced by CWE · can precede (1)

  • CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters weakness

Referenced by CWE · child of (7)

  • CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic weakness
  • CWE-392 Missing Report of Error Condition weakness
  • CWE-393 Return of Wrong Status Code weakness
  • CWE-440 Expected Behavior Violation weakness
  • CWE-446 UI Discrepancy for Security Feature weakness
  • CWE-451 User Interface (UI) Misrepresentation of Critical Information weakness
  • CWE-912 Hidden Functionality weakness