The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
If the product's administrator does not have the ability to manage security-related decisions at all times, then protecting the product from outside threats - including the product's developer - can become impossible. For example, a hard-coded account name and password cannot be changed by the administrator, thus exposing that product to attacks that the administrator can not prevent.

Primary

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Implementation

Other
Varies by Context

The following code is an example of an internal hard-coded password in the back-end:

int VerifyAdmin(char *password) {
if (strcmp(password, "Mew!")) {

printf("Incorrect Password!\n");return(0)
}printf("Entering Diagnostic Mode...\n");return(1);
}

int VerifyAdmin(String password) {if (!password.equals("Mew!")) {return(0)}//Diagnostic Modereturn(1);}

Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this "functionality."

CVE-2022-29953
Condition Monitor firmware has a maintenance interface with hard-coded credentials
https://www.cve.org/CVERecord?id=CVE-2022-29953

CVE-2000-0127
GUI configuration tool does not enable a security option when a checkbox is selected, although that option is honored when manually set in the configuration file.
https://www.cve.org/CVERecord?id=CVE-2000-0127

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

CWE Community
2008-04-11
Draft 9
2008-04-11
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Relationships

CWE Content Team
MITRE
2009-01-12
updated Description, Name

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2010-09-27
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships, Relevant_Properties

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities

Design Principle Violation: Lack of Administrator Control over Security