What CVEs are caused by CWE-1242?

13 recorded CVEs are attributed to CWE-1242, including CVE-2025-12176, CVE-2025-55050, CVE-2017-20204.

Is CWE-1242 actively exploited?

13 recorded CVEs are caused by CWE-1242; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Incomplete

CWE-1242: Inclusion of Undocumented Features or Chicken Bits

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

Real-world CVEs

13 recorded CVEs are caused by CWE-1242 (Inclusion of Undocumented Features or Chicken Bits). The highest-severity and most recent are shown first. 4 new CWE-1242 CVEs have been recorded so far in 2026 (5 in 2025).

Showing 12 of 13 recorded CWE-1242 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-1242 vulnerabilities

Common consequences

What can happen when CWE-1242 is exploited.

Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism

Affects: Confidentiality, Integrity, Availability, Access Control

An attacker might exploit these interfaces for unauthorized access.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Documentation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-1242, grouped by where in the lifecycle they apply.

Architecture and Design

Implementation

The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented "special access features" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.

Vulnerable example

other

Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.

Remove all chicken bits and hidden features that are exposed to attackers. Add authorization schemes that rely on cryptographic primitives to access any features that the manufacturer does not want to expose. Clearly document all interfaces.

Terminology & mappings

Mapped taxonomies

ISA/IEC 62443: Req SD-4 (Part 4-1)
ISA/IEC 62443: Req SVV-3 (Part 4-1)
ISA/IEC 62443: Req CR 2.12 (Part 4-2)

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-1242.

What is CWE-1242?: The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
What CVEs are caused by CWE-1242?: 13 recorded CVEs are attributed to CWE-1242, including CVE-2025-12176, CVE-2025-55050, CVE-2017-20204.
How do you prevent CWE-1242?: The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.
What are the consequences of CWE-1242?: Exploiting CWE-1242 can lead to: Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism.
Is CWE-1242 actively exploited?: 13 recorded CVEs are caused by CWE-1242; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-1242

Get alerted the moment a new CWE-1242 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing