CWE-671: Lack of Administrator Control over Security

Description

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

If the product's administrator does not have the ability to manage security-related decisions at all times, then protecting the product from outside threats - including the product's developer - can become impossible. For example, a hard-coded account name and password cannot be changed by the administrator, thus exposing that product to attacks that the administrator can not prevent.

Potential Impact

Other

Varies by Context

Demonstrative Examples

The following code is an example of an internal hard-coded password in the back-end:

Bad

int VerifyAdmin(char *password) {
               if (strcmp(password, "Mew!")) {
               
               printf("Incorrect Password!\n");return(0)
               }printf("Entering Diagnostic Mode...\n");return(1);
               }

Bad

int VerifyAdmin(String password) {if (!password.equals("Mew!")) {return(0)}//Diagnostic Modereturn(1);}

Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."

Real-World CVE Examples

CVE ID	Description
CVE-2022-29953	Condition Monitor firmware has a maintenance interface with hard-coded credentials
CVE-2000-0127	GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file.

Frequently Asked Questions

What is CWE-671?

CWE-671 (Lack of Administrator Control over Security) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces re...

How can CWE-671 be exploited?

Attackers can exploit CWE-671 (Lack of Administrator Control over Security) to varies by context. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-671?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-671?

CWE-671 is classified as a Class-level weakness (High abstraction). It has been observed in 2 real-world CVEs.