CWEweakness

CWE-912 Hidden Functionality

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Common consequences

• Other, Integrity: Varies by Context, Alter Execution Logic — From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.

Potential mitigations

• [Installation] Always verify the integrity of the product that is being installed.

Detection methods

• Automated Static Analysis: Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.

Observed examples

• CVE-2022-31260: Chain: a digital asset management program has an undisclosed backdoor in the legacy version of a PHP script (CWE-912) that could allow an unauthenticated user to export metadata (CWE-306) • CVE-2022-3203: A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).

Related

Attack pattern · CAPEC (2)

  • CAPEC-133 Try All Common Switches attack pattern
  • CAPEC-190 Reverse Engineer an Executable to Expose Assumed Hidden Functionality attack pattern

Observed example · CVE (2)

  • CVE-2022-3203 On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. vulnerability
  • CVE-2022-31260 In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a… vulnerability

Child of · CWE (1)

  • CWE-684 Incorrect Provision of Specified Functionality weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-133 Try All Common Switches attack pattern
  • CAPEC-190 Reverse Engineer an Executable to Expose Assumed Hidden Functionality attack pattern

Referenced by CVE · weakness (94)

  • CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. vulnerability
  • CVE-2026-114353 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through… vulnerability
  • CVE-2026-100737 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. vulnerability
  • CVE-2026-97627 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. vulnerability
  • CVE-2026-112360 A security vulnerability has been detected in Netis EAP930 1.250905.115454. vulnerability
  • CVE-2026-82829 Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain… vulnerability
  • CVE-2026-80217 Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode… vulnerability
  • CVE-2026-15413 The Link Factory WordPress plugin is a backdoor. vulnerability
  • CVE-2026-18844 The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. vulnerability
  • CVE-2026-11976 The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. vulnerability
  • CVE-2026-14812 The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in… vulnerability
  • CVE-2026-17032 Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing… vulnerability
  • CVE-2026-61515 Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers… vulnerability
  • CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific… vulnerability
  • CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. vulnerability
  • CVE-2026-7413 A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to… vulnerability
  • CVE-2026-41446 Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the… vulnerability
  • CVE-2026-1952 Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. vulnerability
  • CVE-2026-34769 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability
  • CVE-2026-33280 Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging… vulnerability
  • CVE-2026-4621 Hidden Functionality vulnerability in NEC Platforms, Ltd. vulnerability
  • CVE-2026-31847 Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote… vulnerability
  • CVE-2026-3587 An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full… vulnerability
  • CVE-2026-30704 The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB vulnerability
  • CVE-2025-48418 A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0… vulnerability
  • CVE-2026-1741 A vulnerability was determined in EFM ipTIME A8004T 14.18.2. vulnerability
  • CVE-2025-55704 Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of… vulnerability
  • CVE-2025-11544 Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run… vulnerability
  • CVE-2025-62773 Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator. vulnerability
  • CVE-2025-58778 Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. vulnerability
Show all 94 ›

Referenced by CWE · child of (2)

  • CWE-1242 Inclusion of Undocumented Features or Chicken Bits weakness
  • CWE-506 Embedded Malicious Code weakness