CWE-912: Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Hidden functionality can take many forms, such as intentionally malicious code, "Easter Eggs" that contain extraneous functionality such as games, developer-friendly shortcuts that reduce maintenance or support costs such as hard-coded accounts, etc. From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.

Consequences

• Other, Integrity: Varies by Context, Alter Execution Logic

How to prevent it

• Installation: Always verify the integrity of the product that is being installed.

Recent advisories

• GHSA-9wfr-w7mm-pc7f — Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference
• CVE-2025-47729 — The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different…
• CVE-2024-20439 — A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static…
• GHSA-j9cw-5cpj-9qj5 — Moodle has a Hidden Functionality vulnerability
• CVE-2021-25371 — A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

All advisories for CWE-912