Weakness (CWE)
CWE-912: Hidden Functionality
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
How to prevent it (1 mitigation)
-
Installation
Always verify the integrity of the product that is being installed.
Source: MITRE CWE-912
100 results · Feed
-
Critical 9.8
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is pos…
-
High 7.0
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by send…
-
High 7.2
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A us…
-
Medium 4.9
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A us…
-
High 8.0
Netis EAP930 CGI Endpoint debug return200 backdoor
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be ini…
-
Critical 9.8
Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process
Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite…
-
High 8.8
Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and acc…
-
Critical 10.0
Link Factory - Backdoor
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator p…
-
High 8.1
Pulsetto Vagus Nerve Stimulator Hidden Functionality
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet…
-
Critical 9.8
Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full contr…
-
Critical 10.0
Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injecti…
-
Critical 10.0
MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Th…
-
Critical 9.8CVE-2026-61515 Public exploit
Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on…
-
Critical 9.8
Vacron｜IP Camera - Hidden Functionality
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
-
Critical 9.8
Unauthenticated Access to Internal Diagnostic Interface
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boo…
-
High 7.2
Persistent undocumented backdoor access in Yarbo robot
A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factor…
-
Critical 9.8
WattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device la…
-
Critical 9.8
Denial of service via the undocumented subfunction in AS320T
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
-
High 7.8
Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to…
-
Medium 6.3
Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.
-
High 7.2
Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the p…
-
High 8.5
Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnet…
-
Critical 10.0
Hidden CLI Function Allows Root Access
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.
-
Critical 9.1
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible har…
-
Medium 6.4
A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, …
-
Medium 6.6
EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the…
-
Medium 5.3
Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to…
-
Critical 9.5
Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may …
Sharp Display Solutions NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W NP-M363W, NP-M323W, NP-M403X, NP-M363X, NP-M323X, NP-M283X, NP-M403WG, NP-M363WG, NP-M323WG, NP-M403X NP-P627UL, NP-P627ULG, NP-P627UL+, NP-P547UL, NP-P547ULG, NP-P607UL+, NP-CG6600UL, NP-H6271UL, NP-H5471UL, NP-P627ULH, NP-P547ULH, NP-PE455UL, NP-PE455ULG, NP-PE455WL, NP-PE455WLG, NP-PE505X -
Low 2.4
Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.
-
High 7.2
Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in th…
-
High 7.2
PiExtract ｜SOOP-CLM - Hidden Functionality
SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arbitrary code on the server.
-
Medium 4.9
Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled…
-
High 8.8
Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key
An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUs…
-
Medium 6.4
FNKvision Y215 CCTV Camera Telnet Sevice s1_rf_test_config backdoor
A weakness has been identified in FNKvision Y215 CCTV Camera 10.194.120.40. This vulnerability affects unknown code of the file s1_rf_test_config of the component Telnet Sevice. Executing manipulation can lead to backdoor. The physical device can be targeted …
-
Critical 9.3
ProFTPD 1.3.3c Backdoor Command Execution
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell command…
-
Medium 6.3
TOTOLINK N350R Telnet Service formSysTel backdoor
A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated …
-
Critical 10.0CVE-2011-10018 Public exploit
myBB 1.6.4 Backdoor Arbitrary Command Execution
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduce…
-
Medium 4.9
Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may…
-
Critical 9.3
Netcore / Netis Routers RCE via UDP Port 53413 Backdoor
A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An …
-
Medium 6.3
Conjure Position Department Service Quality Evaluation System head.php eval backdoor
A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by this issue is the function eval of the file public/assets/less/bootstrap-less/mixins/head.php. The man…