Inclusion of Undocumented Features or Chicken Bits
CWE-1242
The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as chicken bits. They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Architecture and Design Implementation: The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.
Latest Inclusion of Undocumented Features or Chicken Bits vulnerabilities
- 7.7 High severity
mH-DEVELOPER: Inclusion of Undocumented Features or Chicken Bits
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can g
- 8.8 High severity
MSE6-C2M-5000-FB36-D-M-RG-BAR-M12L4-AGD: Inclusion of Undocumented Features or Chicken Bits
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability.
- 8.1 High severity
UBR-01 Mk II: Inclusion of Undocumented Features or Chicken Bits
A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system.
- 9.8 Critical severity
BLU-IC2: Inclusion of Undocumented Features or Chicken Bits
Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- 7.5 High severity
UD-LT2: Inclusion of Undocumented Features or Chicken Bits
Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports.
- 7.2 High severity
AE1021: Inclusion of Undocumented Features or Chicken Bits
Inclusion of undocumented features or chicken bits issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier, which may allow a logged-in user to enable telnet service.
- 7.5 High severity
UD-LT1: Inclusion of Undocumented Features or Chicken Bits
Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS co