# CWE-912.

Every Advisory and CVE whose sources give the weakness CWE-912, newest first.

## Records, newest first (an older page)

- [MinMax CMS - Hidden Functionality](https://agentprime.io/advisories/CVE-2024-5514.md)
  `CVE-2024-5514` · CVE record: MinMax Digital Technology MinMax CMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2024 · Tags: Hard-coded credentials, CWE-912
- [Siemens SIMATIC RTLS Locating Manager: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All…](https://agentprime.io/advisories/CVE-2024-33583.md)
  `CVE-2024-33583` · CVE record: Siemens SIMATIC RTLS Locating Manager · CVSS 4.8 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-912
- [NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthentica…](https://agentprime.io/advisories/CVE-2024-3016.md)
  `CVE-2024-3016` · CVE record: NEC Platforms, Ltd ITK-6DGS-1(BK) TEL and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 May 2024 · Tags: CWE-912
- [NEC Corporation WG1800HP4: Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3…](https://agentprime.io/advisories/CVE-2024-28011.md)
  `CVE-2024-28011` · CVE record: NEC Corporation WG1800HP4 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Mar 2024 · Tags: CWE-912
- [Siemens SENTRON 3KC ATC6 Expansion Module Ethernet: A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet…](https://agentprime.io/advisories/CVE-2024-22044.md)
  `CVE-2024-22044` · CVE record: Siemens SENTRON 3KC ATC6 Expansion Module Ethernet · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-912
- [PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code execution via hidden command.](https://agentprime.io/advisories/CVE-2023-42134.md)
  `CVE-2023-42134` · CVE record: PAX Technology POS terminals · CVSS 6.8 Medium · Not analysed yet · Published 15 Jan 2024 · Tags: CWE-912
- [Poly Trio 8800 Test Automation Mode backdoor](https://agentprime.io/advisories/CVE-2023-4467.md)
  `CVE-2023-4467` · CVE record: Poly Trio 8800 · CVSS 6.2 Medium · Not analysed yet · Published 29 Dec 2023 · Tags: CWE-912
- [Typecho Page manage-pages.php backdoor](https://agentprime.io/advisories/CVE-2023-6614.md)
  `CVE-2023-6614` · CVE record: Typecho · CVSS 2.7 Low · Not analysed yet · Published 8 Dec 2023 · Tags: CWE-912
- [CBC Co.,Ltd. NR4H, NR8H, NR16H series: Hidden functionality vulnerability in the CBC products allows a remote authenticated…](https://agentprime.io/advisories/CVE-2023-40158.md)
  `CVE-2023-40158` · CVE record: CBC Co.,Ltd. NR4H, NR8H, NR16H series and 4 more · CVSS 8.8 High · Not analysed yet · Published 23 Aug 2023 · Tags: CWE-912
- [In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.](https://agentprime.io/advisories/CVE-2023-25183.md)
  `CVE-2023-25183` · CVE record: Snap One OvrC Cloud · CVSS 8.3 High · Not analysed yet · Published 22 May 2023 · Tags: CWE-912
- [Netgear Orbi Router RBR750: A command execution vulnerability exists in the hidden telnet service functionality of…](https://agentprime.io/advisories/CVE-2022-38452.md)
  `CVE-2022-38452` · CVE record: Netgear Orbi Router RBR750 · CVSS 7.2 High · Not analysed yet · Published 21 Mar 2023 · Tags: CWE-912
- [Netgear Orbi Satellite RBS750: A command execution vulnerability exists in the ubus backend communications functionality…](https://agentprime.io/advisories/CVE-2022-36429.md)
  `CVE-2022-36429` · CVE record: Netgear Orbi Satellite RBS750 · CVSS 7.2 High · Not analysed yet · Published 21 Mar 2023 · Tags: CWE-912
- [Moodle has a Hidden Functionality vulnerability](https://agentprime.io/advisories/GHSA-j9cw-5cpj-9qj5.md)
  `GHSA-j9cw-5cpj-9qj5`, `BIT-moodle-2021-36403`, `CVE-2021-36403`, `PKSA-9gf2-4rwz-pbz6` · Packagist `moodle/moodle`: affected `<3.9.8 || >=3.10.0-beta, <3.10.5 || >=3.11.0-beta, <3.11.1`, fixed in `3.9.8`, `3.10.5`, `3.11.1` · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2023 · Tags: CWE-912
- [MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt).](https://agentprime.io/advisories/CVE-2023-24108.md)
  `CVE-2023-24108` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Feb 2023 · Tags: CWE-912
- [WAGO: Exposure of configuration interface in unmanaged switches](https://agentprime.io/advisories/CVE-2022-3843.md)
  `CVE-2022-3843` · CVE record: WAGO Unmanaged Switch 852-111/000-001 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Feb 2023 · Tags: CWE-912
- [A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker.](https://agentprime.io/advisories/CVE-2022-47767.md)
  `CVE-2022-47767` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jan 2023 · Tags: CWE-912
- [PIXELA CORPORATION PIX-RT100: Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and…](https://agentprime.io/advisories/CVE-2023-22316.md)
  `CVE-2023-22316` · CVE record: PIXELA CORPORATION PIX-RT100 · CVSS 6.5 Medium · Not analysed yet · Published 17 Jan 2023 · Tags: CWE-912
- [Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package.](https://agentprime.io/advisories/CVE-2022-46997.md)
  `CVE-2022-46997` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2022 · Tags: CWE-912
- [vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package.](https://agentprime.io/advisories/CVE-2022-46996.md)
  `CVE-2022-46996` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2022 · Tags: CWE-912
- [sweetalert2 v8.19.1 and above contains hidden functionality](https://agentprime.io/advisories/GHSA-8jh9-wqpf-q52c.md)
  `GHSA-8jh9-wqpf-q52c` · npm `sweetalert2`: affected `>=8.19.1, <11.22.4`, fixed in `11.22.4` · No CVSS score · Not analysed yet · Published 23 Nov 2022 · Tags: CWE-912
- [sweetalert2 v9.17.4 and above contains hidden functionality](https://agentprime.io/advisories/GHSA-pg98-6v7f-2xfv.md)
  `GHSA-pg98-6v7f-2xfv` · npm `sweetalert2`: affected `>=9.17.4, <11.22.4`, fixed in `11.22.4` · No CVSS score · Not analysed yet · Published 23 Nov 2022 · Tags: CWE-912
- [sweetalert2 v10.16.10 and above contains hidden functionality](https://agentprime.io/advisories/GHSA-457r-cqc8-9vj9.md)
  `GHSA-457r-cqc8-9vj9` · npm `sweetalert2`: affected `>=10.16.10, <11.22.4`, fixed in `11.22.4` · No CVSS score · Not analysed yet · Published 23 Nov 2022 · Tags: CWE-912
- [sweetalert2 v11.4.9 and above contains hidden functionality](https://agentprime.io/advisories/GHSA-qq6h-5g6j-q3cm.md)
  `GHSA-qq6h-5g6j-q3cm` · npm `sweetalert2`: affected `>=11.4.9, <11.22.4`, fixed in `11.22.4` · No CVSS score · Not analysed yet · Published 23 Nov 2022 · Tags: CWE-912
- [ORing net IAP-420(+) Hidden Functionality](https://agentprime.io/advisories/CVE-2022-3203.md)
  `CVE-2022-3203` · CVE record: ORing IAP-420(+) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2022 · Tags: CWE-912
- [2.2.3 HIDDEN FUNCTIONALITY CWE-912](https://agentprime.io/advisories/CVE-2022-1741.md)
  `CVE-2022-1741` · CVE record: Dominion Voting Systems ImageCast X application and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 24 Jun 2022 · Tags: CWE-912
- [JUNG Smart Visu Server KNX Group Address backdoor](https://agentprime.io/advisories/CVE-2017-20084.md)
  `CVE-2017-20084` · CVE record: JUNG Smart Visu Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2022 · Tags: CWE-912
- [JUNG Smart Visu Server SSH Server backdoor](https://agentprime.io/advisories/CVE-2017-20083.md)
  `CVE-2017-20083` · CVE record: JUNG Smart Visu Server · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2022 · Tags: CWE-912
- [JUNG Smart Visu Server backdoor](https://agentprime.io/advisories/CVE-2017-20082.md)
  `CVE-2017-20082` · CVE record: JUNG Smart Visu Server · CVSS 5.5 Medium · Not analysed yet · Published 22 Jun 2022 · Tags: CWE-912
- [Malware in ctx](https://agentprime.io/advisories/GHSA-4g82-3jcr-q52w.md)
  `GHSA-4g82-3jcr-q52w` · PyPI `ctx`: affected `<=0.1.4`, no fixed version yet · No CVSS score · Not analysed yet · Published 25 May 2022 · Tags: CWE-912
- [Duplicate Advisory: Embedded malware in ua-parser-js](https://agentprime.io/advisories/GHSA-236c-vhj4-gfxg.md)
  `GHSA-236c-vhj4-gfxg` · npm `ua-parser-js`: affected `>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1`, fixed in `0.7.30`, `0.8.1`, `1.0.1` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 25 May 2022 · Tags: CWE-829, CWE-912
- [Hidden functionality in node-ipc](https://agentprime.io/advisories/GHSA-8gr3-2gjw-jj7g.md)
  `GHSA-8gr3-2gjw-jj7g` · npm `node-ipc`: affected `=9.2.2`, no fixed version yet · No CVSS score · Not analysed yet · Published 16 Mar 2022 · Tags: CWE-912
- [Backdoored Plugins & Themes from AccessPress Themes](https://agentprime.io/advisories/CVE-2021-24867.md)
  `CVE-2021-24867` · CVE record: AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post and 4 more · No CVSS score · EPSS 0.18 · Not analysed yet · Published 21 Feb 2022 · Tags: CWE-912
- [mySCADA myPRO](https://agentprime.io/advisories/CVE-2021-43987.md)
  `CVE-2021-43987` · CVE record: mySCADA myPRO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Dec 2021 · Tags: CWE-912
- [Embedded malware in ua-parser-js](https://agentprime.io/advisories/GHSA-pjwm-rvh2-c87w.md)
  `GHSA-pjwm-rvh2-c87w`, `CVE-2021-4229` · npm `ua-parser-js`: affected `>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1`, fixed in `0.7.30`, `0.8.1`, `1.0.1` · CVSS 5.0 Medium · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-506, CWE-912
- [Cosori: A unauthenticated backdoor exists in the configuration server functionality of Cosori…](https://agentprime.io/advisories/CVE-2020-28593.md)
  `CVE-2020-28593` · CVE record: Cosori · CVSS 8.1 High · Not analysed yet · Published 15 Apr 2021 · Tags: CWE-912
- [A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.](https://agentprime.io/advisories/CVE-2021-25371.md)
  `CVE-2021-25371` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.1 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-912
- [Cisco Firepower Threat Defense Software Hidden Commands Vulnerability](https://agentprime.io/advisories/CVE-2020-3352.md)
  `CVE-2020-3352` · CVE record: Cisco Cisco Firepower Threat Defense Software · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2020 · Tags: CWE-912
- [Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products](https://agentprime.io/advisories/CVE-2020-12504.md)
  `CVE-2020-12504` · CVE record: Pepperl+Fuchs P+F Comtrol RocketLinx and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2020 · Tags: CWE-912
- [N-Tron 702-W / 702M12-W: The affected product is vulnerable due to an undocumented interface found on the device…](https://agentprime.io/advisories/CVE-2020-16204.md)
  `CVE-2020-16204` · CVE record: N-Tron 702-W / 702M12-W · No CVSS score · Not analysed yet · Published 1 Sept 2020 · Tags: CWE-912
- [OpenClinic GA](https://agentprime.io/advisories/CVE-2020-14487.md)
  `CVE-2020-14487` · CVE record: open source OpenClinic GA · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2020 · Tags: CWE-912
- [Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server: All versions of Hangzhou Xiongmai Technology Co…](https://agentprime.io/advisories/CVE-2018-17919.md)
  `CVE-2018-17919` · CVE record: Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server · No CVSS score · Not analysed yet · Published 10 Oct 2018 · Tags: CWE-912

Newest: <https://agentprime.io/advisories/tag/cwe-912.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-912&cursor=WyIyMDI0LTA2LTE3VDAzOjEyOjE0LjEzNzAwMFoiLCJDVkUtMjAyNC02MDQ1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-912/?cursor=WyIyMDI0LTA2LTE3VDAzOjEyOjE0LjEzNzAwMFoiLCJDVkUtMjAyNC02MDQ1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.