CWE-1301

Nombre

Insufficient or Incomplete Data Removal within Hardware Component

Estado

Incomplete

Publicado

2020-08-20
00h00 +00:00

Modificado

2025-12-11
00h00 +00:00

Enlaces oficiales

CWE Mitre.org

Notificaciones para un CWE

Manténgase informado sobre cualquier cambio en un CWE específico.

Gestionar notificaciones

Alertas personalizadas

¡Active sus alertas personalizadas!

Para activar sus alertas, solo necesita iniciar sesión en su cuenta gratuita. Si aún no ha iniciado sesión, elija una de las opciones a continuación.

Iniciar sesión en su cuenta Crear una cuenta gratuita

Notificaciones para un CWE

Manténgase informado sobre cualquier cambio en un CWE específico.

Parámetros

Puede especificar un título que se recuperará en las alertas que se enviarán.

Especifique el ID de CWE que desea monitorear.

Planificación

Mes

Cálculo de la próxima ejecución

Día

Día de la semana

Hora

Minuto

Fecha de creación

Última ejecución

Próxima ejecución

Nombre: Insufficient or Incomplete Data Removal within Hardware Component

The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.

Informaciones generales

Modos de introducción

Implementation

Plataformas aplicables

Lenguaje

Class: Not Language-Specific (Undetermined)

Sistemas operativos

Class: Not OS-Specific (Undetermined)

Arquitecturas

Class: Not Architecture-Specific (Undetermined)

Tecnologías

Class: Not Technology-Specific (Undetermined)

Consecuencias comunes

Alcance	Impacto	Probabilidad
Confidentiality	Read Memory, Read Application Data

Ejemplos observados

Referencias	Descripción
CVE-2019-8575	Firmware Data Deletion Vulnerability in which a base station factory reset might not delete all user information. The impact of this enables a new owner of a used device that has been "factory-default reset" with a vulnerable firmware version can still retrieve, at least, the previous owner's wireless network name, and the previous owner's wireless security (such as WPA2) key. This issue was addressed with improved, data deletion.

Mitigaciones potenciales

Phases : Architecture and Design
Apply blinding or masking techniques to implementations of cryptographic algorithms.
Phases : Implementation
Alter the method of erasure, add protection of media, or destroy the media to protect the data.

Notas de mapeo de vulnerabilidades

Justificación : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentario : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Patrones de ataque relacionados

CAPEC-ID	Nombre del patrón de ataque
CAPEC-37	Retrieve Embedded Sensitive Data An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

Notas

This entry is still under development and will continue to see updates and content improvements.

Referencias

REF-1117

Introduction to differential power analysis and related attacks
Paul Kocher, Joshua Jaffe, Benjamin Jun.
https://www.rambus.com/wp-content/uploads/2015/08/DPATechInfo.pdf

REF-1118

The EM Side-Channel(s)
Dakshi Agrawal, Bruce Archambeault, Josyula R. Rao, Pankaj Rohatgi.
https://link.springer.com/content/pdf/10.1007/3-540-36400-5_4.pdf

REF-1119

RSA key extraction via low-bandwidth acoustic cryptanalysis
Daniel Genkin, Adi Shamir, Eran Tromer.
https://www.iacr.org/archive/crypto2014/86160149/86160149.pdf

REF-1120

Power Analysis for Cheapskates
Colin O'Flynn.
https://media.blackhat.com/eu-13/briefings/OFlynn/bh-eu-13-for-cheapstakes-oflynn-wp.pdf

REF-1055

Data Remanence in Semiconductor Devices
Peter Gutmann.
https://www.usenix.org/legacy/events/sec01/full_papers/gutmann/gutmann.pdf

Envío

Nombre	Organización	Fecha	Fecha de lanzamiento	Version
Nicole Fern	Cycuity (originally submitted as Tortuga Logic)	2020-05-29 +00:00	2020-08-20 +00:00	4.2

Modificaciones

Nombre	Organización	Fecha	Comentario
CWE Content Team	MITRE	2020-12-10 +00:00	updated Relationships
CWE Content Team	MITRE	2021-07-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2021-10-28 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities

Detalle CWE-1301