Weakness · CWE-250
Execution with Unnecessary Privileges
Software runs with more privilege than it needs, so any flaw in it is a flaw with full power.
Official CWE name. Full definition on cwe.mitre.org
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- AC-6Least PrivilegeAccess Control · mitigates 6 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 5 techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 5 techniques
- SI-7Software, Firmware, and Information IntegritySystem and Information Integrity · mitigates 5 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 4 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 4 techniques
- CM-8System Component InventoryConfiguration Management · mitigates 4 techniques
- RA-5Vulnerability Monitoring and ScanningRisk Assessment · mitigates 4 techniques
- SC-7Boundary ProtectionSystem and Communications Protection · mitigates 4 techniques
- AC-2Account ManagementAccess Control · mitigates 3 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.