cve.bz

CWE-671: Lack of Administrator Control over Security

Filter

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used.

What the weakness is: CWE-671 at MITRE. All weaknesses

Ask an AI about CWE-671

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-671: Lack of Administrator Control over Security and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/671.html and https://cve.bz/cve/cwe/671?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-33389EPSS 0.2%

    An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provide…

  2. 8.3CVE-2026-31985EPSS 0.2%

    When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the…

  3. 9.1CVE-2025-24024EPSS 0.6%

    Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration co…

  4. 5.4CVE-2023-20115EPSS 0.6%

    A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying opera…

  5. 4.3CVE-2022-29163EPSS 1.1%

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be pa…

  6. 7.4CVE-2018-13283EPSS 1.4%

    Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command, (2) hostname, or (3) port parameter.