Afaik, as long as a weak cipher is enabled on both client and server, a MITM attacker can force it to be used. It involves manipulating the handshake to tell both parties the other one doesn't support any better cipher.
Unless you have a client which will happily disable a cipher and try again when encountering an error. But if you do that, you don't deserve any security.