CWE-506 (内嵌的恶意代码) — Vulnerability Class 100

CWE-506 represents a critical integrity weakness where software contains intentionally embedded malicious code, often disguised as legitimate functionality. This flaw typically manifests as Trojan horses, trapdoors, or logic bombs, allowing developers or insiders to subvert system security at a predetermined time or under specific conditions. Exploitation occurs when the hidden code executes, granting unauthorized access, stealing data, or disrupting operations while the primary application appears to function normally. To mitigate this risk, organizations must enforce strict code review processes and utilize automated static analysis tools to detect suspicious patterns. Additionally, implementing robust access controls and maintaining transparent development practices ensure that no hidden backdoors remain in the final product, thereby preserving trust and preventing insider threats from compromising system integrity.