Use of Obsolete Function

CWE-477

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

As programming languages evolve, functions occasionally become obsolete due to: Advances in the language Improved understanding of how operations should be performed effectively and securely Changes in the conventions that govern certain operations Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.

We track 11 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.3.

How this weakness is prevented

Implementation: Refer to the documentation for the obsolete function in order to determine why it is deprecated or obsolete and to learn about alternative ways to achieve the same functionality.
Requirements: Consider seriously the security implications of using an obsolete function. Consider using alternate functions.

Latest Use of Obsolete Function vulnerabilities

7.5 High severity
PcVue: Use of Obsolete Function
CVE-2026-1693Feb 26, 2026Arcinfo
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a
9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
CVE-2025-49217Jun 17, 2025Trend MicroEPSS 1.17%
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method
9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Use of Obsolete Function
CVE-2025-49216Jun 17, 2025Trend Micro
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
8.8 High severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
CVE-2025-49214Jun 17, 2025Trend Micro
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code
9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
CVE-2025-49213Jun 17, 2025Trend MicroEPSS 14.2%
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method
9.8 Critical severity
Trend Micro Endpoint Encryption Policy Server: Deserialization of Untrusted Data
CVE-2025-49212Jun 17, 2025Trend MicroEPSS 14.2%
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method
9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
CVE-2025-49220Jun 17, 2025Trend MicroEPSS 2.21%
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
9.8 Critical severity
Trend Micro Apex Central: Deserialization of Untrusted Data
CVE-2025-49219Jun 17, 2025Trend MicroEPSS 1.52%
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method
8.8 High severity
SIMATIC NET PC Software V14: Use of Obsolete Function
CVE-2023-28829Jun 13, 2023Siemens
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions
9.8 Critical severity
SICK FX0-GENT00000, SICK FX0-GENT00030, SICK…: Missing Authentication for Critical Functionality
CVE-2023-23451Apr 19, 2023SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000, SICK FX0-GMOD00010, SICK FX0-GPNT00000, SICK FX0-GPNT00030, SICK UE410-EN1, SICK UE410-EN3, SICK UE410-EN3S04, SICK UE410-EN4
The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW
8.8 High severity
Mattermost: Missing Authorization
CVE-2022-1384Apr 19, 2022Mattermost
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might