CAPEC-212
Functionality Misuse
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-212: Functionality Misuse: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/212.html and https://cve.bz/cve/capec/212?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The adversary has the capability to interact with the application directly.The target system does not adequately implement safeguards to prevent misuse of authorized actions/processes.
Skills required
- Low skill
General computer knowledge about how applications are launched, how they interact with input/output, and how they are configured.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality | A successful attack of this kind can compromise the confidentiality of an authorized user's credentials. |
| Other | Confidentiality, Integrity, Availability | Depending on the adversary's intended technical impact, a successful attack of this kind can compromise any or all elements of the security triad. |
Mitigations
Perform comprehensive threat modeling, a process of identifying, evaluating, and mitigating potential threats to the application. This effort can help reveal potentially obscure application functionality that can be manipulated for malicious purposes.
When implementing security features, consider how they can be misused and compromised.
Weaknesses it exploits
- CWE-1242 Inclusion of Undocumented Features or Chicken Bits
- CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories
- CWE-1281 Sequence of Processor Instructions Leads to Unexpected Behavior
Recent CVEs with these weaknesses
- 7.7CVE-2026-82928
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the match…
- 9.1CVE-2025-51679
An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior.
- 6.5CVE-2026-47233
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` han…
- 8.8CVE-2023-3634
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- 8.1CVE-2025-41756
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
- 6.5CVE-2025-41754
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.
- 8.7CVE-2026-24714
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
- 8.7CVE-2021-47796
Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on port 80 enforces authentication, the backdoor service allo…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- More specific patterns
MITRE's words, unchanged: CAPEC-212 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.