CWE-671 · Misconfiguration and Insecure Design
Lack of Administrator Control over Security
6CVEs
SortMost likely exploited
6 CVEs with CWE-671 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-13283Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks v…Synology · SSL VPN Client · CVSS 8.8 · 2019-04-01 | 8.8 | 1.4% | 2019-04-01 |
| CVE-2022-29163Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Servernextcloud · security-advisories · CVSS 3.5 · 2022-05-20 | 3.5 | 1.1% | 2022-05-20 |
| CVE-2025-24024Mjolnir v1.9.0 accepts commands from any roommatrix-org · mjolnir · CVSS 9.1 · 2025-01-21 | 9.1 | 0.6% | 2025-01-21 |
| CVE-2023-20115A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attac…Cisco · Cisco NX-OS Software · CVSS 5.4 · 2023-08-23 | 5.4 | 0.6% | 2023-08-23 |
| CVE-2026-31985Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0Nozomi Networks · Remote Collector · CVSS 8.1 · 2026-07-09 | 8.1 | 0.2% | 2026-07-09 |
| CVE-2026-33389Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0Nozomi Networks · Guardian · CVSS 7.5 · 2026-09-08 | 7.5 | 0.2% | 2026-09-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.