---
title: "CWE-254: 7PK - Security Features"
url: https://radicalnotion.ai/cwe/cwe-254
type: cwe
description: "Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management."
updated: 2026-05-01
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# CWE-254: 7PK - Security Features

- **Status:** Incomplete
- **CVEs with this as primary weakness:** 379
- **Of those, in CISA KEV:** 0
- **New in 2026:** 0
- **CWE catalog version:** 4.20

## Description

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

## Real CVEs with this weakness (sample of 12 of 379)

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2016-5788 | - | critical | 10.0 | - | No | 2016-11-25 |
| CVE-2015-3972 | - | critical | 10.0 | - | No | 2015-10-28 |
| CVE-2015-1158 | - | critical | 10.0 | - | No | 2015-06-26 |
| CVE-2019-15149 | Undirectional routing wasn't respected in some cases in Mitogen | critical | 9.8 | - | No | 2019-08-18 |
| CVE-2017-8227 | - | critical | 9.8 | - | No | 2019-07-03 |
| CVE-2011-3145 | mount.ecrpytfs\_private sets group owner of /etc/mtab to user's primary group | critical | 9.8 | - | No | 2019-04-22 |
| CVE-2016-9568 | - | critical | 9.8 | - | No | 2018-02-19 |
| CVE-2011-4889 | - | critical | 9.8 | - | No | 2018-02-08 |
| CVE-2016-0332 | - | critical | 9.8 | - | No | 2018-01-12 |
| CVE-2014-5334 | - | critical | 9.8 | - | No | 2018-01-08 |
| CVE-2015-6473 | - | critical | 9.8 | - | No | 2017-08-22 |
| CVE-2015-9065 | - | critical | 9.8 | - | No | 2017-08-18 |

## Frequently asked questions

### What is CWE-254?

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

### What CVEs are caused by CWE-254?

379 recorded CVEs are attributed to CWE-254, including CVE-2016-5788, CVE-2015-3972 and CVE-2015-1158.

### Is CWE-254 actively exploited?

379 recorded CVEs are caused by CWE-254; none are currently in CISA's KEV catalog of actively exploited flaws.

Primary source: [MITRE CWE](https://cwe.mitre.org/data/definitions/254.html)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/cwe/cwe-254). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.