# CWE-912: Hidden Functionality

> As of 2026-10-30, CWE-912 (Hidden Functionality) underlies 3 CVEs tracked by Threadlinqs, none of them in the CISA Known Exploited Vulnerabilities catalog, and is cited by 44 tracked threats.

**Last updated:** 2026-10-30

## What is CWE-912?

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Hidden functionality can take many forms, such as intentionally malicious code, "Easter Eggs" that contain extraneous functionality such as games, developer-friendly shortcuts that reduce maintenance or support costs such as hard-coded accounts, etc. From a security perspective, even when the functionality is not intentionally malicious or damaging, it can increase the product's attack surface and expose additional weaknesses beyond what is already exposed by the intended functionality. Even if it is not easily accessible, the hidden functionality could be useful for attacks that modify the control flow of the application.

CWE-912 is a class-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Not Language-Specific; Technology: Not Technology-Specific; Technology: ICS/OT.

_Source: [MITRE CWE](https://cwe.mitre.org/data/definitions/912.html) (CWE-912 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data._

## Consequences

- **Other, Integrity** — Varies by Context, Alter Execution Logic

_Source: MITRE CWE, common consequences._

## How CWE-912 is exploited in the wild

Threadlinqs maps 3 CVEs to CWE-912, published between 2025-03-28 and 2026-10-28. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 1 critical, 1 medium. The highest EPSS score in the set is 27.9% (CVE-2025-34117), the modelled probability of exploitation in the next 30 days. 44 tracked threats reference CWE-912 directly or through a CVE it covers; the most recent is “Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code Execution” (2026-10-12). Affected products concentrate in D-Link (1), Netcore Technology (1), Netis (1), among 4 vendors in total.

## Vulnerabilities (CVEs)

All 3 CVEs mapped to CWE-912, CISA KEV first, then by CVSS score.

- [CVE-2026-118579](https://intel.threadlinqs.com/cve/CVE-2026-118579) — CVSS 9.8 critical · EPSS 0.7% · published 2026-10-28
- [CVE-2025-2894](https://intel.threadlinqs.com/cve/CVE-2025-2894) — CVSS 6.6 medium · EPSS 0.7% · published 2025-03-28
- [CVE-2025-34117](https://intel.threadlinqs.com/cve/CVE-2025-34117) — EPSS 27.9% · published 2025-07-16

## Affected vendors

- [D-Link](https://intel.threadlinqs.com/vendors/d-link) — 1 CVE
- **Netcore Technology** — 1 CVE
- **Netis** — 1 CVE
- [Unitree](https://intel.threadlinqs.com/vendors/unitree) — 1 CVE

## Threat activity

44 tracked threats cite CWE-912; the 25 most recent are listed.

- [Malicious 'pyronut' PyPI Package (Trojanized Pyrogram) Backdoors Telegram Bots with Remote Code Execution](https://intel.threadlinqs.com/threat/TL-2026-3366) — HIGH · 2026-10-12
- [Cisco Talos disclosure: Microsoft, Adobe, Apple, and Foxit vulnerabilities (CVE-2026-48388, CVE-2026-57256, CVE-2026-91799, CVE-2026-50475, CVE-2026-58613, CVE-2026-80093, CVE-2026-49177)](https://intel.threadlinqs.com/threat/TL-2026-3011) — HIGH · 2026-10-07
- [Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected](https://intel.threadlinqs.com/threat/TL-2026-2524) — CRITICAL · 2026-09-15
- [Popular Rust Crates arrayref, internment, append-only-vec Compromised in Build-Time Supply Chain Attack via proc-macro1 Typosquat (DPRK/Sapphire Sleet)](https://intel.threadlinqs.com/threat/TL-2026-2085) — CRITICAL · 2026-08-20
- [Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time](https://intel.threadlinqs.com/threat/TL-2026-2089) — CRITICAL · 2026-08-20
- [Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack](https://intel.threadlinqs.com/threat/TL-2026-1860) — CRITICAL · 2026-08-04
- [Shai-Hulud NPM Worm Compromises keyv, file-entry-cache, flat-cache and Hundreds of Popular npm Packages via Maintainer Account Takeover](https://intel.threadlinqs.com/threat/TL-2026-1863) — CRITICAL · 2026-08-04
- [AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale](https://intel.threadlinqs.com/threat/TL-2026-1867) — MEDIUM · 2026-08-04
- [AISI Cyber Test: Autonomous AI Agent (Anthropic Claude Mythos 5) Attempts Supply-Chain Attack via Social Engineering of Open-Source Maintainer](https://intel.threadlinqs.com/threat/TL-2026-1900) — CRITICAL · 2026-08-04
- [US FCC Bans Imported Advanced Robots Over Supply-Chain Risk and UniPwn-Class Takeover Vulnerabilities (CVE-2025-35027)](https://intel.threadlinqs.com/threat/TL-2026-1751) — HIGH · 2026-07-29
- [North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials](https://intel.threadlinqs.com/threat/TL-2026-1571) — HIGH · 2026-07-20
- [OTTERCOOKIE Malware Hidden in SVG Flag Images Backdoors Developers via Fake Coding Tests (Contagious Interview / REF9403)](https://intel.threadlinqs.com/threat/TL-2026-1581) — HIGH · 2026-07-20
- [Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)](https://intel.threadlinqs.com/threat/TL-2026-1450) — HIGH · 2026-07-18
- [North Korea-Linked Contagious Interview Actors (REF9403) Hide OtterCookie-Aligned Malware in SVG Flag Images](https://intel.threadlinqs.com/threat/TL-2026-1452) — HIGH · 2026-07-17
- [TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain](https://intel.threadlinqs.com/threat/TL-2026-1366) — HIGH · 2026-07-15
- [Compromised @injectivelabs/sdk-ts npm Package (v1.20.21) Exfiltrates Cryptocurrency Wallet Mnemonics and Private Keys via Fake Telemetry](https://intel.threadlinqs.com/threat/TL-2026-1381) — HIGH · 2026-07-15
- [StegoAd Campaign: 119 Malicious Microsoft Edge Extensions Deliver Steganographic Malware to 2.6M Users](https://intel.threadlinqs.com/threat/TL-2026-1207) — HIGH · 2026-07-11
- [StegoAd Campaign: 119 Malicious Edge Extensions Hid Malware in Images, Fonts, and Config Files, Up to 2.6M Installs](https://intel.threadlinqs.com/threat/TL-2026-1221) — HIGH · 2026-07-11
- [npm Supply-Chain Backdoor in @injectivelabs/sdk-ts v1.20.21 Exfiltrates Crypto Wallet Seed Phrases and Private Keys](https://intel.threadlinqs.com/threat/TL-2026-1149) — CRITICAL · 2026-07-08
- [Alibaba to Ban Claude Code Over Alleged Embedded Network-Fingerprinting Mechanism](https://intel.threadlinqs.com/threat/TL-2026-1096) — MEDIUM · 2026-07-03
- [Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026](https://intel.threadlinqs.com/threat/TL-2026-0993) — CRITICAL · 2026-06-28
- [Fake 'Beloved PBN Entegrasyonu' WordPress Plugin Drops Dual Webshells via Database Injection](https://intel.threadlinqs.com/threat/TL-2026-2205) — CRITICAL · 2026-06-16
- [Awesome Motive WordPress Plugin Supply-Chain Attack (OptinMonster, TrustPulse, PushEngage) Delivering Self-Hiding Backdoor via Poisoned CDN JavaScript](https://intel.threadlinqs.com/threat/TL-2026-0801) — CRITICAL · 2026-06-15
- [SHEETCREEP: C# Windows RAT Abusing the Google Sheets API v4 for Command-and-Control (APT36 / Transparent Tribe)](https://intel.threadlinqs.com/threat/TL-2026-0784) — HIGH · 2026-06-12
- [Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer](https://intel.threadlinqs.com/threat/TL-2026-0709) — CRITICAL · 2026-06-07

## Mitigations

- **Installation**: Always verify the integrity of the product that is being installed.

_Source: MITRE CWE, potential mitigations._

## Detection methods (MITRE CWE)

- **Automated Static Analysis**: Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.

_Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher._

## Related weaknesses

- [CWE-684](https://cwe.mitre.org/data/definitions/684.html)

Canonical: https://intel.threadlinqs.com/cwe/CWE-912
Source definition: https://cwe.mitre.org/data/definitions/912.html
Detection rules and IOCs for threats exploiting CWE-912 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp