CWE-912 · Supply Chain and Malicious Code
Hidden Functionality
98CVEs
3exploited
1with a public check
2likely (EPSS 10%+)
SortMost likely exploited
98 CVEs with CWE-912 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-20439In CISA KEVExploitedHardcoded Admin Credentials For Cisco Smart Licensing Utility APICisco · Cisco Smart License Utility · CVSS 9.8 · 2024-09-04 | 9.8 | 97% | 2024-09-04 |
| CVE-2021-25371In CISA KEVExploitedA vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.Samsung Mobile · Samsung Mobile Devices · CVSS 6.1 · 2021-03-26 | 6.1 | 0.8% | 2021-03-26 |
| CVE-2025-47729In CISA KEVExploitedThe TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than describe…TeleMessage · archiving backend · CVSS 1.9 · 2025-05-08 | 1.9 | 0.5% | 2025-05-08 |
| CVE-2010-20103CheckProFTPd-1.3.3c - Backdoor Command ExecutionProFTPD Project · ProFTPD (Professional FTP Daemon) · CVSS 9.3 · 2025-08-20 | 9.3 | 15% | 2025-08-20 |
| CVE-2025-34117Netcore / Netis Routers RCE via UDP Port 53413 BackdoorNetcore Technology · Router firmware · CVSS 9.3 · 2025-07-16 | 9.3 | 21% | 2025-07-16 |
| CVE-2021-24867Backdoored Plugins & Themes from AccessPress ThemesAccessPress Themes · Frontend Post WordPress Plugin – AccessPress Anonymous Post · 2022-02-21 | – | 18% | 2022-02-21 |
| CVE-2024-6045D-Link router - Hidden BackdoorD-Link · G403 · CVSS 8.8 · 2024-06-17 | 8.8 | 6.3% | 2024-06-17 |
| CVE-2020-16204The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W…Redlion · N-Tron 702-W / 702M12-W · 2020-09-01 | – | 5.5% | 2020-09-01 |
| CVE-2011-10018myBB 1.6.4 Backdoor Arbitrary Command ExecutionmyBB Group · Forum Software · CVSS 10 · 2025-08-13 | 10.0 | 3.0% | 2025-08-13 |
| CVE-2020-12504Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx productsPepperl+Fuchs · P+F Comtrol RocketLinx · CVSS 9.8 · 2020-10-15 | 9.8 | 3.0% | 2020-10-15 |
| CVE-2026-61515Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShellPuwell Technology Inc. · IP Camera · CVSS 9.8 · 2026-08-04 | 9.8 | 2.4% | 2026-08-04 |
| CVE-2020-14487OpenClinic GAFreemedsoftware · OpenClinic GA · CVSS 9.4 · 2020-07-29 | 9.4 | 2.2% | 2020-07-29 |
| CVE-2022-38452A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrar…Netgear · Orbi Router RBR750 · CVSS 7.2 · 2023-03-21 | 7.2 | 2.1% | 2023-03-21 |
| CVE-2022-36429A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arb…Netgear · Orbi Satellite RBS750 · CVSS 7.2 · 2023-03-21 | 7.2 | 2.0% | 2023-03-21 |
| CVE-2020-28593A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code ex…Cosori · Cosori · CVSS 8.1 · 2021-04-15 | 8.1 | 1.9% | 2021-04-15 |
| CVE-2025-32370Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProvi…Kentico · Xperience · CVSS 7.2 · 2025-04-06 | 7.2 | 1.6% | 2025-04-06 |
| CVE-2021-4229ua-parser-js Crypto Mining backdoorUa-Parser-Js Project · ua-parser-js · CVSS 5 · 2022-05-24 | 5.0 | 1.5% | 2022-05-24 |
| CVE-2022-46996vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to…Vsphere Selfuse Project · Vsphere Selfuse · CVSS 9.8 · 2022-12-14 | 9.8 | 1.4% | 2022-12-14 |
| CVE-2025-27840Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).Espressif · ESP32 · CVSS 6.8 · 2025-03-08 | 6.8 | 1.4% | 2025-03-08 |
| CVE-2023-24108MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerability allows attacke…Zetacomponents · Mvctools · CVSS 9.8 · 2023-02-22 | 9.8 | 1.4% | 2023-02-22 |
| CVE-2024-39754A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attack…Wavlink · Wavlink AC3000 · CVSS 10 · 2025-01-14 | 10.0 | 1.3% | 2025-01-14 |
| CVE-2023-40158Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the af…CBC Co.,Ltd. · NR4H, NR8H, NR16H series · CVSS 8.8 · 2023-08-23 | 8.8 | 1.3% | 2023-08-23 |
| CVE-2022-47767A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmwa…Solar-Log · Solar-Log 250 Firmware · CVSS 9.8 · 2023-01-25 | 9.8 | 1.3% | 2023-01-25 |
| CVE-2021-43987mySCADA myPROmySCADA · myPRO · CVSS 9.8 · 2021-12-23 | 9.8 | 1.3% | 2021-12-23 |
| CVE-2022-46997Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access…Passhunt Project · Passhunt · CVSS 9.8 · 2022-12-14 | 9.8 | 1.2% | 2022-12-14 |
| CVE-2025-0626Hidden Functionality vulnerability in Contec Health CMS8000 Patient MonitorContec Health · CMS8000 Patient Monitor · CVSS 7.5 · 2025-01-30 | 7.5 | 1.1% | 2025-01-30 |
| CVE-2022-3203ORing net IAP-420(+) Hidden FunctionalityORing · IAP-420(+) · CVSS 9.8 · 2022-10-21 | 9.8 | 1.0% | 2022-10-21 |
| CVE-2024-45697D-Link WiFi router - Hidden FunctionalityD-Link · DIR-X4860 A1 · CVSS 9.8 · 2024-09-16 | 9.8 | 1.0% | 2024-09-16 |
| CVE-2018-17919All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login…Hangzhou Xiongmai Technology Co., Ltd · XMeye P2P Cloud Server · 2018-10-10 | – | 1.0% | 2018-10-10 |
| CVE-2024-13062An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. Refer to the ' 01/02/2025 ASUS Router AiClou…ASUS · Router · CVSS 7.2 · 2025-01-02 | 7.2 | 1.0% | 2025-01-02 |
| CVE-2025-2894Unitree Go1 Robot Dog Backdoor Control ChannelUnitree · Go1 · CVSS 6.6 · 2025-03-28 | 6.6 | 0.9% | 2025-03-28 |
| CVE-2022-3843WAGO: Exposure of configuration interface in unmanaged switchesWAGO · Unmanaged Switch 852-111/000-001 · CVSS 9.1 · 2023-02-16 | 9.1 | 0.9% | 2023-02-16 |
| CVE-2026-14812Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)Premium SEO · CVSS 10 · 2026-08-06 | 10.0 | 0.8% | 2026-08-06 |
| CVE-2026-118579D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoorD-Link · DIR-505 · CVSS 9.8 · 2026-10-28 | 9.8 | 0.8% | 2026-10-28 |
| CVE-2026-11405Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interfaceTenda · firmware · CVSS 9.8 · 2026-07-06 | 9.8 | 0.8% | 2026-07-06 |
| CVE-2026-4769Unauthenticated Access to Internal Diagnostic InterfaceWAGO · 0765-110x/0100-0000 · CVSS 9.8 · 2026-07-13 | 9.8 | 0.8% | 2026-07-13 |
| CVE-2026-1741EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoorEFM · ipTIME A8004T · CVSS 6.6 · 2026-02-02 | 6.6 | 0.8% | 2026-02-02 |
| CVE-2026-3587Hidden CLI Function Allows Root AccessWAGO · Lean Managed Switch 852-1812 · CVSS 10 · 2026-03-23 | 10.0 | 0.7% | 2026-03-23 |
| CVE-2026-18191Vacron｜IP Camera - Hidden FunctionalityVacron · VIN-DS783E-E6 · CVSS 9.8 · 2026-07-29 | 9.8 | 0.7% | 2026-07-29 |
| CVE-2024-3016NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local netwo…NEC Platforms, Ltd · ITK-6DGS-1(BK) TEL · CVSS 9.1 · 2024-05-09 | 9.1 | 0.7% | 2024-05-09 |
| CVE-2024-47001Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command…TAKENAKA ENGINEERING CO., LTD. · HDVR-400 · CVSS 8.8 · 2024-09-18 | 8.8 | 0.7% | 2024-09-18 |
| CVE-2023-6614Typecho Page manage-pages.php backdoorTypecho · Typecho · CVSS 2.7 · 2023-12-08 | 2.7 | 0.6% | 2023-12-08 |
| CVE-2023-25183In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub dev…Snap One · OvrC Cloud · CVSS 8.3 · 2023-05-22 | 8.3 | 0.6% | 2023-05-22 |
| CVE-2024-28011Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP…NEC Corporation · WG1800HP4 · CVSS 9.8 · 2024-03-28 | 9.8 | 0.6% | 2024-03-28 |
| CVE-2024-5633Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to an undocumented bin…Longse Technology · LBH30FE200W · CVSS 7.5 · 2024-07-09 | 7.5 | 0.6% | 2024-07-09 |
| CVE-2024-45696D-Link WiFi router - Hidden FunctionalityD-Link · DIR-X4860 A1 · CVSS 8.8 · 2024-09-16 | 8.8 | 0.6% | 2024-09-16 |
| CVE-2025-58778Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone w…Ruijie Networks Co., Ltd. · RG-EST300 · CVSS 8.6 · 2025-10-16 | 8.6 | 0.6% | 2025-10-16 |
| CVE-2024-10773SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacksSICK AG · SICK InspectorP61x · CVSS 9 · 2024-12-06 | 9.0 | 0.6% | 2024-12-06 |
| CVE-2025-48418A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 thro…Fortinet · FortiAnalyzer · CVSS 6.4 · 2026-03-10 | 6.4 | 0.6% | 2026-03-10 |
| CVE-2025-11673PiExtract ｜SOOP-CLM - Hidden FunctionalityPiExtract · SOOP-CLM · CVSS 7.2 · 2025-10-13 | 7.2 | 0.6% | 2025-10-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.