CWE-671 is a product that uses security features in a way that stops its administrator from tailoring security settings to the environment. The result is weaknesses the administrator cannot fix, or a product that cannot operate at the security level the administrator wants. It affects vendors of devices, appliances and software that customers run themselves.
How it happens
MITRE puts it plainly: if the administrator cannot manage security decisions at all times, protecting the product from outside threats, including from its developer, can become impossible. The example in the record is a hard-coded account name and password. The administrator cannot change it, so the product is exposed to attacks the administrator cannot prevent.
Two CVEs in the record show the pattern.
- CVE-2022-29953: Condition Monitor firmware has a maintenance interface with hard-coded credentials.
- CVE-2000-0127: a GUI configuration tool does not enable a security option when a checkbox is selected, although the option is honored when set manually in the configuration file.
The second is a quieter version. The control exists, but the interface the administrator uses does not actually apply it.
# Vulnerable: the admin cannot rotate or remove this account
MAINT_USER = "service"
MAINT_PASS = "k3ep0ut"
What an attacker gains
MITRE lists the impact as varying by context. With a fixed credential, anyone who learns it can use it against every deployment, and no administrator can close the door.
How to find it
The record lists no detection methods. Search for hard-coded accounts and keys in source and firmware images, and check each security setting end to end: change it in the UI, then verify that behavior actually changes.
How to fix it
MITRE lists no formal mitigations on this entry. Follow from the description:
- Give the administrator control over every security-relevant credential and setting.
- Remove hard-coded accounts, or force a change at first use.
- Test that each setting in the interface takes effect.
- Document how to disable maintenance interfaces.
For hard-coded secrets in your own code, a secrets scan of your dependency files is a first pass, and a source scan covers the rest.
Quick check
Why is a hard-coded password a control problem and not only a secrecy problem?
Because the administrator cannot change it, so even a well-run deployment stays exposed once the value is known.
