Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.
CWE-511 Base Incomplete
Logic/Time Bomb
A logic or time bomb is malicious code intentionally placed within software to trigger harmful actions when a specific condition is met or a predetermined time is reached.
Definition
What is CWE-511?
A logic or time bomb is malicious code intentionally placed within software to trigger harmful actions when a specific condition is met or a predetermined time is reached.
This hidden code acts like a delayed-action trap within an application. When its triggering condition occurs—such as a specific date passing or a particular logical state being reached—it executes a payload designed to disrupt normal operations. This trigger could be embedded in either a replicating piece of malware (like a virus) or a non-replicating malicious component.
Once activated, the bomb's payload often aims to cause a denial of service. Common outcomes include crashing the system, corrupting or deleting essential data, or severely degrading performance. Developers should be vigilant for such code in third-party components, during code reviews, and as a potential insider threat, as it represents a deliberate act of sabotage.
Real-world impact
Real-world CVEs caused by CWE-511
No public CVE references are linked to this CWE in MITRE's catalog yet.
How attackers exploit it
Step-by-step attacker path
- 1
Identify a code path that handles untrusted input without validation.
- 2
Craft a payload that exercises the unsafe behavior — injection, traversal, overflow, or logic abuse.
- 3
Deliver the payload through a normal request and observe the application's reaction.
- 4
Iterate until the response leaks data, executes attacker code, or escalates privileges.
Vulnerable code example
Vulnerable pseudo
MITRE has not published a code example for this CWE. The pattern below is illustrative — see Resources for canonical references.
// Example pattern — see MITRE for the canonical references.
function handleRequest(input) {
// Untrusted input flows directly into the sensitive sink.
return executeUnsafe(input);
} Secure code example
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-511
- Installation Always verify the integrity of the product that is being installed.
- Testing Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
Detection signals
How to detect CWE-511
Run dynamic application security testing against the live endpoint.
Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.
Code review: flag any new code that handles input from this surface without using the validated framework helpers.
CWE-511
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Frequently asked questions What is CWE-511?
How serious is CWE-511?
What languages or platforms are affected by CWE-511?
How can I prevent CWE-511?
How does Plexicus detect and fix CWE-511?
Where can I learn more about CWE-511?
Frequently asked questions
What is CWE-511?
A logic or time bomb is malicious code intentionally placed within software to trigger harmful actions when a specific condition is met or a predetermined time is reached.
How serious is CWE-511?
MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.
What languages or platforms are affected by CWE-511?
MITRE lists the following affected platforms: Mobile.
How can I prevent CWE-511?
Always verify the integrity of the product that is being installed. Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
How does Plexicus detect and fix CWE-511?
Plexicus's SAST engine matches the data-flow signature for CWE-511 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-511?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/511.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Related weaknesses
Weaknesses related to CWE-511
CWE-506 Parent
Embedded Malicious Code
This vulnerability occurs when an application or codebase contains intentionally harmful code inserted by a developer or third party.
CWE-507 Sibling
Trojan Horse
A Trojan Horse vulnerability occurs when software presents itself as legitimate and useful, but secretly contains malicious functionality…
CWE-510 Sibling
Trapdoor
A trapdoor, often called a backdoor, is a hidden piece of code intentionally placed within software. It activates in response to a…
CWE-512 Sibling
Spyware
Spyware is software that secretly gathers personal information about a user or their activities. It does this by accessing data from other…
Resources
Further reading
- MITRE — official CWE-511 https://cwe.mitre.org/data/definitions/511.html
- Mobile App Top 10 List https://www.veracode.com/blog/2010/12/mobile-app-top-10-list
- A Taxonomy of Computer Program Security Flaws, with Examples https://cwe.mitre.org/documents/sources/ATaxonomyofComputerProgramSecurityFlawswithExamples%5BLandwehr93%5D.pdf
Ready to validate what matters?
Ready to validate what matters?
Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.