Detalle CWE-1253

CWE-1253

Incorrect Selection of Fuse Values
Draft
2020-02-24
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notificaciones para un CWE
Manténgase informado sobre cualquier cambio en un CWE específico.
Gestionar notificaciones

Nombre: Incorrect Selection of Fuse Values

The logic level used to set a system to a secure state relies on a fuse being unblown.

Informaciones generales

Modos de introducción

Architecture and Design
Implementation

Plataformas aplicables

Lenguaje

Class: Not Language-Specific (Undetermined)

Sistemas operativos

Class: Not OS-Specific (Undetermined)

Arquitecturas

Class: Not Architecture-Specific (Undetermined)

Tecnologías

Class: Not Technology-Specific (Undetermined)

Consecuencias comunes

Alcance Impacto Probabilidad
Access Control
Authorization		Bypass Protection Mechanism, Gain Privileges or Assume Identity

Note: If the logic used to determine system-security state (by leveraging the values sensed from the fuses) uses negative logic, an attacker might blow the fuse and drive the system to an insecure state.
AvailabilityDoS: Crash, Exit, or Restart
ConfidentialityRead Memory
IntegrityModify Memory, Execute Unauthorized Code or Commands

Mitigaciones potenciales

Phases : Architecture and Design
Logic should be designed in a way that blown fuses do not put the product into an insecure state that can be leveraged by an attacker.

Notas de mapeo de vulnerabilidades

Justificación : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentario : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Patrones de ataque relacionados

CAPEC-ID Nombre del patrón de ataque
CAPEC-74 Manipulating State

Notas

This entry is still under development and will continue to see updates and content improvements.

Referencias

REF-1080

Security Failures in Secure Devices
Christopher Tarnovsky.
https://www.blackhat.com/presentations/bh-europe-08/Tarnovsky/Presentation/bh-eu-08-tarnovsky.pdf

Envío

Nombre Organización Fecha Fecha de lanzamiento Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi Intel Corporation 2019-10-15 +00:00 2020-02-24 +00:00 4.1

Modificaciones

Nombre Organización Fecha Comentario
CWE Content Team MITRE 2020-08-20 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Description
CWE Content Team MITRE 2021-07-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2021-10-28 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Common_Consequences, Description, Weakness_Ordinalities
La información presentada en CVE Find proviene de varias fuentes de referencia cuidadosamente seleccionadas. Los datos CVE son proporcionados por MITRE Corporation y la Base de Datos Nacional de Vulnerabilidades (NVD). El catálogo de Vulnerabilidades Explotadas Conocidas (KEV) proviene de la Agencia de Seguridad de Infraestructura y Ciberseguridad (CISA), mientras que las puntuaciones EPSS provienen de FIRST.org. Además, los datos sobre debilidades de software (CWE) y patrones de ataque comunes (CAPEC) son mantenidos por MITRE Corporation, y la información sobre configuraciones de hardware y software (CPE) es proporcionada por la NVD.