Home/CWE/Violation of Secure Design Principles
Weakness

Violation of Secure Design Principles

CWE-657 · Class · Draft

The product violates well-established principles for secure design.

Extended description

This can introduce resultant weaknesses or make it easier for developers to introduce related weaknesses during implementation. Because code is centered around design, it can be resource-intensive to fix design problems.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-710 · Improper Adherence to Coding Standards
Children (more specific)
ParentOfCWE-1192 · Improper Identifier for IP Block used in System-On-Chip (SOC)
ParentOfCWE-1395 · Dependency on Vulnerable Third-Party Component
ParentOfCWE-250 · Execution with Unnecessary Privileges
ParentOfCWE-636 · Not Failing Securely ('Failing Open')
ParentOfCWE-637 · Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
ParentOfCWE-638 · Not Using Complete Mediation
ParentOfCWE-653 · Improper Isolation or Compartmentalization
ParentOfCWE-654 · Reliance on a Single Factor in a Security Decision
ParentOfCWE-655 · Insufficient Psychological Acceptability
ParentOfCWE-656 · Reliance on Security Through Obscurity
ParentOfCWE-671 · Lack of Administrator Control over Security
⚠

CVEs With This Weakness

19
A sample of the 19 CVEs tagged with this weakness.
CVECVE-2026-39888
CVECVE-2026-30792
CVECVE-2025-54255
CVECVE-2025-24887
CVECVE-2024-57957
CVECVE-2024-33849
CVECVE-2024-26139
CVECVE-2023-52714
CVECVE-2023-29320
CVECVE-2022-30683
CVECVE-2022-28244
CVECVE-2021-44714
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin