Falhas do tipo CWE-912

94 resultados

Funcionalidade oculta

A aplicação contém código ou lógica que não é documentada, não é evidente na interface e não é esperada pelos usuários ou administradores. Essa funcionalidade oculta pode ser explorada por atacantes para contornar controles de segurança, acessar dados sensíveis ou executar ações não autorizadas.

Exemplo

Um firmware de roteador contém um endpoint HTTP oculto que aceita comandos de shell sem autenticação. Desenvolvedores esqueceram de remover código de debug, e atacantes descobrem a funcionalidade ao fazer engenharia reversa, ganhando acesso administrativo total ao dispositivo.

Como mitigar

Remova todo código debug, backdoors e funcionalidades não documentadas antes de liberar para produção. Implemente revisão de código rigorosa, testes de segurança estáticos/dinâmicos e auditoria de binários para detectar lógica inesperada. Documente e mantenha registrado tudo o que a aplicação deve fazer.

CVE-2025-1204HIGHThe "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existingEPSS 0.5%CVE-2025-47729LOWThe TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which iEPSS 0.4%KEVCVE-2026-31847HIGHHidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+EPSS 0.4%CVE-2026-41446CRITICALWattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic EndpointsEPSS 0.4%CVE-2024-37990HIGHA vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6EPSS 0.4%CVE-2026-33280HIGHHidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging fuEPSS 0.4%CVE-2026-97627HIGHHidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to EPSS 0.4%CVE-2017-20083MEDIUMJUNG Smart Visu Server SSH Server backdoorEPSS 0.4%CVE-2017-20082MEDIUMJUNG Smart Visu Server backdoorEPSS 0.4%CVE-2025-46267MEDIUMHidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remoEPSS 0.4%CVE-2025-8938MEDIUMTOTOLINK N350R Telnet Service formSysTel backdoorEPSS 0.4%CVE-2017-20084MEDIUMJUNG Smart Visu Server KNX Group Address backdoorEPSS 0.4%CVE-2025-55075MEDIUMHidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authentiEPSS 0.3%CVE-2025-6839MEDIUMConjure Position Department Service Quality Evaluation System head.php eval backdoorEPSS 0.3%CVE-2026-30704CRITICALThe WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCBEPSS 0.3%CVE-2024-37994MEDIUMA vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6EPSS 0.3%CVE-2026-34769HIGHElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceEPSS 0.3%CVE-2025-11544CRITICALImproper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthEPSS 0.3%CVE-2023-22316MEDIUMHidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker EPSS 0.3%CVE-2026-82829CRITICALHidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication processEPSS 0.3%