CWE · MITRE source
CWE-506Embedded Malicious Code
The product contains code that appears to be malicious in nature.
Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 16 mapping(s) from 5 framework(s): ATT&CK 10 (mostly) · CAPEC 3 (full) · STIG oracle linux 9 1 (partial) · STIG rhel 9 1 (partial) · OWASP-Web 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A08:2025 Software or Data Integrity Failures.
NIST 800-53 r5 controls that address this weakness (35)AI
Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SR-1 | Policy and Procedures | SR | Supply chain risk management procedures include controls to detect and prevent insertion of malicious code through suppliers and vendors. |
SR-10 | Inspection of Systems or Components | SR | Direct inspection of components can detect embedded malicious code inserted through supply-chain or runtime tampering. |
SR-11 | Component Authenticity | SR | Counterfeit components are a common vector for embedding malicious code; preventing their entry reduces this exposure. |
SA-1 | Policy and Procedures | SA | Acquisition procedures can prescribe integrity checks, code review, and provenance validation to reduce introduction of embedded malicious code. |
SA-10 | Developer Configuration Management | SA | Requiring documented, approved changes plus security flaw tracking makes undetected insertion of malicious code substantially harder. |
SA-12 | Supply Chain Protection | SA | The control mandates vetting suppliers and tamper detection, making it harder for malicious code to be embedded by upstream providers. |
SC-18 | Mobile Code | SC | Monitoring mobile code usage enables detection of embedded malicious code delivered through allowed mobile code channels. |
SC-25 | Thin Nodes | SC | Reduced code footprint and storage make insertion or persistence of embedded malicious code far less feasible. |
SC-29 | Heterogeneity | SC | Embedding malicious code becomes far harder to achieve uniformly when components use heterogeneous languages, runtimes, and hardware. |
CM-10 | Software Usage Restrictions | CM | Restricting software to licensed versions and controlling P2P prevents introduction of software containing embedded malicious code from unauthorized sources. |
CM-11 | User-installed Software | CM | The control prevents users from installing software that contains embedded malicious code. |
CM-8 | System Component Inventory | CM | Regular inventory reviews and updates make it harder to conceal or exploit embedded malicious code by requiring all components to be documented and accounted for. |
SI-14 | Non-persistence | SI | Any embedded malicious code or backdoor written into an instance is erased at termination, rendering persistence mechanisms ineffective across successive instances. |
SI-3 | Malicious Code Protection | SI | Directly detects and eradicates embedded malicious code at entry/exit points via periodic and real-time scans. |
SI-7 | Software, Firmware, and Information Integrity | SI | Unauthorized insertion of malicious code into software or firmware is revealed by integrity monitoring. |
Show 20 more broadly-applicable controls
SR-2 | Supply Chain Risk Management Plan | SR | A supply chain risk management plan requires vetting suppliers and components to prevent introduction of embedded malicious code throughout the system lifecycle. |
SR-3 | Supply Chain Controls and Processes | SR | Identifying weaknesses and applying supplier controls reduces the likelihood of embedded malicious code being introduced through procured elements. |
SR-4 | Provenance | SR | Valid provenance monitoring makes insertion of embedded malicious code during supply chain or development stages detectable. |
SR-5 | Acquisition Strategies, Tools, and Methods | SR | Acquisition strategies can require trusted suppliers, code reviews, and integrity attestations that directly reduce the likelihood of receiving components with embedded malicious code. |
SR-6 | Supplier Assessments and Reviews | SR | Reviews of suppliers and their deliverables can detect or deter introduction of embedded malicious code. |
SR-8 | Notification Agreements | SR | Notification agreements enable suppliers to alert acquirers to discovered or suspected embedded malicious code, directly supporting detection and response. |
SR-9 | Tamper Resistance and Detection | SR | Tamper detection mechanisms can identify embedded malicious code inserted via supply-chain or runtime tampering. |
SA-13 | Trustworthiness | SA | Directly reduces risk of embedded malicious code by requiring verification that acquired or developed components perform only as specified without hidden malicious behavior. |
SA-19 | Component Authenticity | SA | Authenticity verification and anti-counterfeit procedures detect and block components that may contain embedded malicious code or backdoors. |
SA-20 | Customized Development of Critical Components | SA | In-house development of critical components eliminates the attack surface of vendor-embedded malicious code. |
SA-21 | Developer Screening | SA | Screening developers for trustworthiness and appropriate authorizations directly reduces the likelihood that a malicious insider will intentionally embed malicious code during development. |
SA-6 | Software Usage Restrictions | SA | Mandating only contract-approved software reduces the chance of introducing binaries that contain embedded malicious code. |
SC-34 | Non-modifiable Executable Programs | SC | Prevents embedding or persistence of malicious code in the OS or specified applications since the media cannot be written. |
SC-44 | Detonation Chambers | SC | Detonation chambers directly detect and analyze embedded malicious code by executing it in isolation before it reaches production systems. |
RA-10 | Threat Hunting | RA | The capability explicitly searches for embedded malicious code and backdoors as indicators of compromise. |
RA-6 | Technical Surveillance Countermeasures Survey | RA | TSCM directly targets and removes embedded malicious hardware or code planted for ongoing technical surveillance. |
CP-10 | System Recovery and Reconstitution | CP | Reverting to a known state removes any malicious code embedded by an attacker. |
MA-3 | Maintenance Tools | MA | The approval and review process for maintenance tools can prevent introduction or continued use of tools containing embedded malicious code. |
PM-30 | Supply Chain Risk Management Strategy | PM | Supply chain strategy requires vetting and controls during acquisition to prevent or detect insertion of malicious code by vendors or integrators. |
PS-2 | Position Risk Designation | PS | Background screening for development or deployment roles makes intentional insertion of malicious code by insiders materially harder to accomplish. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
T1027.009 Embedded Payloads←MT1195 Supply Chain Compromise←P →MT1195.001 Compromise Software Dependencies and Development Tools←PT1195.002 Compromise Software Supply Chain←M →MT1218.001 Compiled HTML File←PT1221 Template Injection←PT1505 Server Software Component←M →PT1525 Implant Internal Image←M →MT1542 Pre-OS Boot←P →PT1554 Compromise Host Software Binary←M →M
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-4978 KEV | 10.0 | 8.4 | 0.2694 | 2024-05-23 |
CVE-2025-30066 KEV | 10.0 | 8.6 | 0.4101 | 2025-03-15 |
CVE-2025-30154 KEV | 10.0 | 8.6 | 0.0230 | 2025-03-19 |
CVE-2025-54313 KEV UPD | 10.0 | 7.5 | 0.0415 | 2025-07-19 |
CVE-2025-59374 KEV | 10.0 | 9.8 | 0.0108 | 2025-12-17 |
CVE-2026-33634 KEV | 10.0 | 8.8 | 0.6037 | 2026-03-23 |
CVE-2026-45321 KEV UPD | 10.0 | 9.6 | 0.0234 | 2026-05-12 |
CVE-2026-8398 KEV UPD | 10.0 | 9.8 | 0.0146 | 2026-05-15 |
CVE-2026-48027 KEV UPD | 10.0 | 9.8 | 0.0185 | 2026-05-27 |
CVE-2024-3094 UPD | 8.0 | 10.0 | 0.8597 | 2024-03-29 |
CVE-2017-16128 | 7.0 | 9.8 | 0.0146 | 2018-06-07 |
CVE-2020-15165 | 7.0 | 9.3 | 0.0132 | 2020-08-28 |
CVE-2023-2003 | 7.0 | 9.1 | 0.0091 | 2023-07-13 |
CVE-2025-10894 | 7.0 | 9.6 | 0.0053 | 2025-09-24 |
CVE-2026-31976 | 7.0 | 9.8 | 0.0050 | 2026-03-11 |
CVE-2026-34841 | 7.0 | 9.8 | 0.0023 | 2026-04-06 |
CVE-2026-34424 | 7.0 | 9.8 | 0.0055 | 2026-04-09 |
CVE-2026-6443 | 7.0 | 9.8 | 0.0050 | 2026-04-17 |
CVE-2026-44484 UPD | 7.0 | 9.8 | 0.0039 | 2026-05-14 |
CVE-2026-45758 UPD | 7.0 | 9.6 | 0.0028 | 2026-06-05 |
CVE-2017-16047 | 5.5 | 7.5 | 0.0127 | 2018-05-29 |
CVE-2017-16061 | 5.5 | 7.5 | 0.0111 | 2018-05-29 |
CVE-2017-16062 | 5.5 | 7.5 | 0.0108 | 2018-05-29 |
CVE-2017-16044 | 5.5 | 7.5 | 0.0147 | 2018-06-04 |
CVE-2017-16045 | 5.5 | 7.5 | 0.0112 | 2018-06-04 |