CWE · MITRE source
CWE-684Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.
Last updated: 15 October 2026 14:21 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): STIG rhel 9 1 (partial)
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
—
—
—
NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-6 | Security and Privacy Function Verification | SI | Periodic checks confirm that specified security and privacy functions are actually provided and operating. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2024-50357 UPD | 7.3 | 9.8 | 0.0055 | 2024-11-29 |
CVE-2023-24845 UPD | 7.0 | 9.1 | 0.0069 | 2023-08-08 |
CVE-2024-6425 UPD | 6.9 | 9.1 | 0.0054 | 2024-07-01 |
CVE-2023-5363 UPD | 6.4 | 7.5 | 0.0333 | 2023-10-25 |
CVE-2023-4258 UPD | 6.3 | 8.6 | 0.0057 | 2023-09-25 |
CVE-2025-47227 UPD | 6.2 | 7.5 | 0.0192 | 2025-07-05 |
CVE-2026-34478 UPD | 6.1 | 7.5 | 0.0119 | 2026-04-10 |
CVE-2025-66384 UPD | 5.9 | 8.2 | 0.0036 | 2025-11-28 |
CVE-2026-30791 UPD | 5.8 | 7.5 | 0.0034 | 2026-03-05 |
CVE-2026-3598 UPD | 5.8 | 7.5 | 0.0033 | 2026-03-05 |
CVE-2025-58325 UPD | 5.7 | 8.2 | 0.0029 | 2025-10-14 |
CVE-2024-20317 UPD | 5.3 | 7.4 | 0.0024 | 2024-09-11 |
CVE-2026-42255 | 5.3 | 7.2 | 0.0035 | 2026-04-26 |
CVE-2026-40685 | 5.1 | 6.5 | 0.0057 | 2026-04-30 |
CVE-2026-106361 UPD | 5.0 | 6.5 | 0.0029 | 2026-10-06 |
CVE-2026-40684 | 4.8 | 5.9 | 0.0061 | 2026-04-30 |
CVE-2023-5158 UPD | 4.7 | 6.5 | 0.0021 | 2023-09-25 |
CVE-2024-6502 UPD | 4.6 | 5.7 | 0.0037 | 2024-08-22 |
CVE-2026-79126 | 4.5 | 5.9 | 0.0024 | 2026-08-25 |
CVE-2022-23728 UPD | 4.4 | 6.1 | 0.0010 | 2022-01-21 |
CVE-2024-5005 UPD | 3.7 | 4.3 | 0.0040 | 2024-10-11 |
CVE-2020-11054 UPD | 3.5 | 3.5 | 0.0151 | 2020-05-07 |
CVE-2025-54567 UPD | 3.5 | 4.2 | 0.0027 | 2025-07-25 |
CVE-2026-106390 | 3.5 | 4.3 | 0.0020 | 2026-10-06 |
CVE-2026-44597 UPD | 3.4 | 3.7 | 0.0063 | 2026-05-07 |