Cyber Posture

CWE · MITRE source

CWE-15External Control of System or Configuration Setting

Abstraction: Base · CVEs in our corpus: 59

One or more system settings or configuration elements can be externally controlled by a user.

Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (9)AI

Showing the 5 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
CM-1Policy and ProceduresCMThe policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.
CM-2Baseline ConfigurationCMBaseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.
CM-3Configuration Change ControlCMRequires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.
RA-5Vulnerability Monitoring and ScanningRAVulnerability scanners directly detect externally controllable or misconfigured settings using standardized checklists.
SI-22Information DiversitySIProvides fallback sources for configuration or settings when the primary is externally corrupted or controlled.
Show 4 more broadly-applicable controls
CM-4Impact AnalysesCMImpact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.
CM-5Access Restrictions for ChangeCMRestricting changes to system and configuration settings prevents external entities from controlling those settings without approval.
CM-6Configuration SettingsCMEstablishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.
CM-9Configuration Management PlanCMThe plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-433236.16.50.80802023-09-28
CVE-2023-502522.28.30.09632023-12-12
CVE-2024-109792.28.80.06862024-11-14
CVE-2024-386662.29.10.05852025-01-14
CVE-2024-392802.29.10.05852025-01-14
CVE-2023-462482.09.00.03282023-10-31
CVE-2024-43262.09.80.00652024-05-16
CVE-2026-227082.09.80.00072026-01-14
CVE-2024-515441.98.20.04192024-12-05
CVE-2021-384531.89.10.00252021-10-22
CVE-2021-274061.88.80.00272022-10-14
CVE-2024-396021.89.10.00402025-01-14
CVE-2024-397881.89.10.00042025-01-14
CVE-2024-397891.89.10.00052025-01-14
CVE-2024-397901.89.10.00042025-01-14
CVE-2024-397931.89.10.00042025-01-14
CVE-2024-397941.89.10.00052025-01-14
CVE-2024-397951.89.10.00042025-01-14
CVE-2024-397981.89.10.00352025-01-14
CVE-2024-397991.89.10.00352025-01-14
CVE-2024-398001.89.10.00352025-01-14
CVE-2024-515431.78.20.00292024-12-05
CVE-2026-272031.78.30.00022026-02-21
CVE-2026-412941.78.60.00012026-04-21
CVE-2021-313381.67.80.00052021-08-19