cve.bz

CWE-1242: Inclusion of Undocumented Features or Chicken Bits

Filter

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

What the weakness is: CWE-1242 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-36 Using Unpublished Interfaces or Functionality Likelihood: Medium · Severity: High
  • CAPEC-212 Functionality Misuse Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-1242, as MITRE names them. Credits.

Ask an AI about CWE-1242

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1242: Inclusion of Undocumented Features or Chicken Bits and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1242.html and https://cve.bz/cve/cwe/1242?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.7CVE-2026-82928EPSS 0.2%

    mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the match…

  2. 8.8CVE-2023-3634EPSS 0.6%

    In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.

  3. 8.1CVE-2025-41756EPSS 0.4%

    A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.

  4. 6.5CVE-2025-41754EPSS 0.4%

    A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrary files on the system.

  5. 8.7CVE-2026-24714EPSS 0.2%

    Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.

  6. 8.7CVE-2021-47796EPSS 0.8%

    Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on port 80 enforces authentication, the backdoor service allo…

  7. 8.7CVE-2021-4469EPSS 0.5%

    Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the primary web interface on port 80 enforces authentication, the backdoor service allo…

  8. 10.0CVE-2025-12176EPSS 0.3%

    Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  9. 9.3CVE-2017-20204EPSS 0.7%

    DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet administrative interface that allows remote authentication as an undocumented user via a proprietary challenge–response scheme whic…

  10. 9.8CVE-2025-55050EPSS 0.3%

    CWE-1242: Inclusion of Undocumented Features

  11. 6.9CVE-2025-52548EPSS 0.4%

    E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application serv…

  12. 7.5CVE-2025-22450EPSS 0.4%

    Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.

  13. 7.2CVE-2024-54457EPSS 0.4%

    Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.

  14. 7.5CVE-2024-52564EPSS 0.6%

    Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a resul…

  15. 6.5CVE-2024-7011EPSS 0.3%

    Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525WLG, NP-P525WLJL, NP-CG6500UL, NP-CG6500WL, NP-CG6700UL, NP-P605UL, NP-P605UL+, NP-P605ULG, NP-P605U…

  16. 6.5CVE-2024-2103EPSS 0.5%

    Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably: SEL-700BT Motor Bus Transf…