What CVEs are caused by CWE-912?

76 recorded CVEs are attributed to CWE-912, including CVE-2024-20439, CVE-2021-25371, CVE-2025-47729. 3 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

What are the consequences of CWE-912?

Exploiting CWE-912 can lead to: Varies by Context, Alter Execution Logic.

Is CWE-912 actively exploited?

Yes. 3 CWE-912 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 76 recorded CVEs.

Class weakness

Incomplete

CWE-912: Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Class

Abstraction

MITRE classification

Overview

Hidden functionality can take many forms, such as intentionally malicious code, "Easter Eggs" that contain extraneous functionality such as games, developer-friendly shortcuts that reduce maintenance or support costs such as hard-coded accounts, etc. From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.

Real-world CVEs

76 recorded CVEs are caused by CWE-912 (Hidden Functionality), including 3 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 12 new CWE-912 CVEs have been recorded so far in 2026 (22 in 2025).

Showing 12 of 76 recorded CWE-912 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-912 vulnerabilities

Common consequences

What can happen when CWE-912 is exploited.

Varies by Context, Alter Execution Logic

Affects: Other, Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Implementation

Applies to

Technologies

ICS/OT

How to prevent it

Practical mitigations for CWE-912, grouped by where in the lifecycle they apply.

Installation

Always verify the integrity of the product that is being installed.

How to detect it

Automated Static Analysis

Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the example below, a malicous developer has injected code to send credit card numbers to the developer's own email address.

Vulnerable example

java

boolean authorizeCard(String ccn) {

Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented "special access features" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.

Vulnerable example

other

Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.

Remove all chicken bits and hidden features that are exposed to attackers. Add authorization schemes that rely on cryptographic primitives to access any features that the manufacturer does not want to expose. Clearly document all interfaces.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2022-31260 — Chain: a digital asset management program has an undisclosed backdoor in the legacy version of a PHP script (CWE-912) that could allow an unauthenticated user to export metadata (CWE-306)
CVE-2022-3203 — A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-912.

What is CWE-912?: The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
What CVEs are caused by CWE-912?: 76 recorded CVEs are attributed to CWE-912, including CVE-2024-20439, CVE-2021-25371, CVE-2025-47729. 3 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
How do you prevent CWE-912?: Always verify the integrity of the product that is being installed.
How is CWE-912 detected?: Automated Static Analysis: Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
What are the consequences of CWE-912?: Exploiting CWE-912 can lead to: Varies by Context, Alter Execution Logic.
Is CWE-912 actively exploited?: Yes. 3 CWE-912 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 76 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-912

Get alerted the moment a new CWE-912 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing