CWE-671: Lack of Administrator Control over Security
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
扩展描述
If the product's administrator does not have the ability to manage security-related decisions at all times, then protecting the product from outside threats - including the product's developer - can become impossible. For example, a hard-coded account name and password cannot be changed by the administrator, thus exposing that product to attacks that the administrator can not prevent.
常见后果
影响范围: Other
技术影响: Varies by Context
观察示例
参考: CVE-2022-29953
Condition Monitor firmware has a maintenance interface with hard-coded credentials
参考: CVE-2000-0127
GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file.
引入模式
| 阶段 | 说明 |
|---|---|
| Architecture and Design | OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase. |
| Implementation | - |