What is CWE-912?
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
Hidden functionality can take many forms, such as intentionally malicious code, "Easter Eggs" that contain extraneous functionality such as games, developer-friendly shortcuts that reduce maintenance or support costs such as hard-coded accounts, etc. From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.
CWE-912 is a class-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific; Technology: Not Technology-Specific; Technology: ICS/OT.
Source: MITRE CWE (CWE-912 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data.
Consequences
- Other, Integrity — Varies by Context, Alter Execution Logic
Source: MITRE CWE, common consequences.
How CWE-912 is exploited in the wild
Threadlinqs maps 3 CVEs to CWE-912, published between 2025-03-28 and 2026-10-28. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 1 critical, 1 medium. The highest EPSS score in the set is 27.9% (CVE-2025-34117), the modelled probability of exploitation in the next 30 days. 44 tracked threats reference CWE-912 directly or through a CVE it covers; the most recent is “Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code Execution” (2026-10-12). Affected products concentrate in D-Link (1), Netcore Technology (1), Netis (1), among 4 vendors in total.
Vulnerabilities (CVEs)
All 3 CVEs mapped to CWE-912, CISA KEV first, then by CVSS score.
- CVE-2026-118579 — CVSS 9.8 critical · EPSS 0.7% · published 2026-10-28
- CVE-2025-2894 — CVSS 6.6 medium · EPSS 0.7% · published 2025-03-28
- CVE-2025-34117 — EPSS 27.9% · published 2025-07-16
Affected vendors
Threat activity
44 tracked threats cite CWE-912; the 25 most recent are listed.
- Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code ExecutionHIGH
- Cisco Talos disclosure: Microsoft, Adobe, Apple, and Foxit vulnerabilities (CVE-2026-48388, CVE-2026-57256, CVE-2026-91799, CVE-2026-50475, CVE-2026-58613, CVE-2026-80093, CVE-2026-49177)HIGH
- Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites AffectedCRITICAL
- Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)CRITICAL
- Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile timeCRITICAL
- Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain AttackCRITICAL
- Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account TakeoverCRITICAL
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud ScaleMEDIUM
- AISI Cyber Test: Autonomous AI Agent (Anthropic Claude Mythos 5) Attempts Supply-Chain Attack via Social Engineering of Open-Source MaintainerCRITICAL
- US FCC Bans Imported Advanced Robots Over Supply-Chain Risk and UniPwn-Class Takeover Vulnerabilities (CVE-2025-35027)HIGH
- North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer CredentialsHIGH
- OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403)HIGH
- Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)HIGH
- North Korea-Linked Contagious Interview Actors (REF9403) Hide OtterCookie-Aligned Malware in SVG Flag ImagesHIGH
- TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit ChainHIGH
- Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake TelemetryHIGH
- StegoAd Campaign: 119 Malicious Microsoft Edge Extensions Deliver Steganographic Malware to 2.6M UsersHIGH
- StegoAd Campaign: 119 Malicious Edge Extensions Hid Malware in Images, Fonts, and Config Files, Up to 2.6M InstallsHIGH
- npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private KeysCRITICAL
- Alibaba to Ban Claude Code Over Alleged Embedded Network-Fingerprinting MechanismMEDIUM
- Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026CRITICAL
- Fake 'Beloved PBN Entegrasyonu' WordPress Plugin Drops Dual Webshells via Database InjectionCRITICAL
- Awesome Motive WordPress Plugin Supply-Chain Attack (OptinMonster, TrustPulse, PushEngage) Delivering Self-Hiding Backdoor via Poisoned CDN JavaScriptCRITICAL
- SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 for Command-and-Control (APT36 / Transparent Tribe)HIGH
- Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential StealerCRITICAL
Mitigations
- Installation: Always verify the integrity of the product that is being installed.
Source: MITRE CWE, potential mitigations.
Detection methods (MITRE CWE)
- Automated Static Analysis: Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher.