Detail Kelemahan Perangkat Lunak CWE-1194 | CVE Find

Vendor dan Produk

CPE, singkatan dari Common Platform Enumeration, adalah skema standar untuk penamaan perangkat keras, perangkat lunak, dan sistem operasi. CPE menyediakan skema penamaan terstruktur untuk mengidentifikasi dan mengklasifikasikan sistem teknologi informasi, platform, dan paket secara unik berdasarkan atribut tertentu seperti vendor, nama produk, versi, pembaruan, edisi, dan bahasa.

Nama: Hardware Design

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Anggota CWE

CWE-1195: Manufacturing and Life Cycle Management Concerns Kategori

CWE-1195: Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.

CWE-1059: Insufficient Technical Documentation Dasar

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Dasar

CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device Dasar

CWE-1269: Product Released in Non-Release Configuration Dasar

CWE-1273: Device Unlock Credential Sharing Dasar

CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors Dasar

CWE-1196: Security Flow Issues Kategori

CWE-1196: Weaknesses in this category are related to improper design of full-system security flows, including but not limited to secure boot, secure update, and hardware-device attestation.

CWE-1190: DMA Device Enabled Too Early in Boot Phase Dasar

CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control Dasar

CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels Dasar

CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code Dasar

CWE-1283: Mutable Attestation or Measurement Reporting Data Dasar

CWE-1310: Missing Ability to Patch ROM Code Dasar

CWE-1326: Missing Immutable Root of Trust in Hardware Dasar

CWE-1328: Security Version Number Mutable to Older Versions Dasar

CWE-1197: Integration Issues Kategori

CWE-1197: Weaknesses in this category are those that arise due to integration of multiple hardware Intellectual Property (IP) cores, from System-on-a-Chip (SoC) subsystem interactions, or from hardware platform subsystem interactions.

CWE-1276: Hardware Child Block Incorrectly Connected to Parent System Dasar

CWE-1198: Privilege Separation and Access Control Issues Kategori

CWE-1198: Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

CWE-276: Incorrect Default Permissions Dasar

CWE-441: Unintended Proxy or Intermediary Dasar

CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) Dasar

CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC) Dasar

CWE-1220: Insufficient Granularity of Access Control Dasar

CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks Dasar

CWE-1242: Inclusion of Undocumented Features or Chicken Bits Dasar

CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges Dasar

CWE-1262: Improper Access Control for Register Interface Dasar

CWE-1267: Policy Uses Obsolete Encoding Dasar

CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents Dasar

CWE-1280: Access Control Check Implemented After Asset is Accessed Dasar

CWE-1294: Insecure Security Identifier Mechanism Dasar

CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface Dasar

CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) Dasar

CWE-1303: Non-Transparent Sharing of Microarchitectural Resources Dasar

CWE-1314: Missing Write Protection for Parametric Data Values Dasar

CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses Dasar

CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy Dasar

CWE-1420: Exposure of Sensitive Information during Transient Execution Dasar

CWE-1199: General Circuit and Logic Design Concerns Kategori

CWE-1199: Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL.

CWE-1209: Failure to Disable Reserved Bits Dasar

CWE-1221: Incorrect Register Defaults or Module Parameters Dasar

CWE-1223: Race Condition for Write-Once Attributes Dasar

CWE-1224: Improper Restriction of Write-Once Bit Fields Dasar

CWE-1231: Improper Prevention of Lock Bit Modification Dasar

CWE-1232: Improper Lock Behavior After Power State Transition Dasar

CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection Dasar

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Dasar

CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic Dasar

CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State Dasar

CWE-1253: Incorrect Selection of Fuse Values Dasar

CWE-1254: Incorrect Comparison Logic Granularity Dasar

CWE-1261: Improper Handling of Single Event Upsets Dasar

CWE-1298: Hardware Logic Contains Race Conditions Dasar

CWE-1201: Core and Compute Issues Kategori

CWE-1201: Weaknesses in this category are typically associated with CPUs, Graphics, Vision, AI, FPGA, and microcontrollers.

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations Dasar

CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior Dasar

CWE-1342: Information Exposure through Microarchitectural State after Transient Execution Dasar

CWE-1420: Exposure of Sensitive Information during Transient Execution Dasar

CWE-1202: Memory and Storage Issues Kategori

CWE-1202: Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

CWE-226: Sensitive Information in Resource Not Removed Before Reuse Dasar

CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories Dasar

CWE-1251: Mirrored Regions with Different Values Dasar

CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions Dasar

CWE-1282: Assumed-Immutable Data is Stored in Writable Memory Dasar

CWE-1420: Exposure of Sensitive Information during Transient Execution Dasar

CWE-1203: Peripherals, On-chip Fabric, and Interface/IO Problems Kategori

CWE-1203: Weaknesses in this category are related to hardware security problems that apply to peripheral devices, IO interfaces, on-chip interconnects, network-on-chip (NoC), and buses. For example, this category includes issues related to design of hardware interconnect and/or protocols such as PCIe, USB, SMBUS, general-purpose IO pins, and user-input peripherals such as mouse and keyboard.

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge Dasar

CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall Dasar

CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point Dasar

CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges Dasar

CWE-1317: Improper Access Control in Fabric Bridge Dasar

CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC) Dasar

CWE-1205: Security Primitives and Cryptography Issues Kategori

CWE-1205: Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).

CWE-203: Observable Discrepancy Dasar

CWE-325: Missing Cryptographic Step Dasar

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation Dasar

CWE-1241: Use of Predictable Algorithm in Random Number Generator Dasar

CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready Dasar

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Dasar

CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs Dasar

CWE-1206: Power, Clock, Thermal, and Reset Concerns Kategori

CWE-1206: Weaknesses in this category are related to system power, voltage, current, temperature, clocks, system state saving/restoring, and resets at the platform and SoC level.

CWE-1232: Improper Lock Behavior After Power State Transition Dasar

CWE-1247: Improper Protection Against Voltage and Clock Glitches Dasar

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Dasar

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Dasar

CWE-1256: Improper Restriction of Software Interfaces to Hardware Features Dasar

CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings Dasar

CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation Dasar

CWE-1314: Missing Write Protection for Parametric Data Values Dasar

CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals Dasar

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Dasar

CWE-1338: Improper Protections Against Hardware Overheating Dasar

CWE-1207: Debug and Test Problems Kategori

CWE-1207: Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

CWE-1191: On-Chip Debug and Test Interface With Improper Access Control Dasar

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Dasar

CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug Dasar

CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State Dasar

CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information Dasar

CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition Dasar

CWE-1291: Public Key Re-Use for Signing both Debug and Production Code Dasar

CWE-1295: Debug Messages Revealing Unnecessary Information Dasar

CWE-1296: Incorrect Chaining or Granularity of Debug Components Dasar

CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime Dasar

CWE-1323: Improper Management of Sensitive Trace Data Dasar

CWE-319: Cleartext Transmission of Sensitive Information Dasar

CWE-1208: Cross-Cutting Problems Kategori

CWE-1208: Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

CWE-440: Expected Behavior Violation Dasar

CWE-1053: Missing Documentation for Design Dasar

CWE-1059: Insufficient Technical Documentation Dasar

CWE-1263: Improper Physical Access Control Dasar

CWE-1277: Firmware Not Updateable Dasar

CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component Dasar

CWE-1329: Reliance on Component That is Not Updateable Dasar

CWE-1357: Reliance on Insufficiently Trustworthy Component Dasar

CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface Dasar

CWE-1388: Physical Access Issues and Concerns Kategori

CWE-1388: Weaknesses in this category are related to concerns of physical access.

CWE-1384: Improper Handling of Physical or Environmental Conditions Dasar

CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) Dasar

CWE-1247: Improper Protection Against Voltage and Clock Glitches Dasar

CWE-1261: Improper Handling of Single Event Upsets Dasar

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Dasar

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Dasar

CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Dasar

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Dasar

CWE-1300: Improper Protection of Physical Side Channels Dasar

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan

This view attempts to present hardware weaknesses in a simple and intuitive way. As such it uses a single level of abstraction. The same category could contain weaknesses that have parent/child relationships within View-1000. By exploring View-1000 relationships for the weaknesses that are included, one can find deeper relationships between some hardware weaknesses.
The top level categories in this view represent commonly understood areas/terms within hardware design, and are meant to aid the user in identifying potential related weaknesses. It is possible for the same weakness to exist within multiple different categories.

Audiens

Pemangku kepentingan	Deskripsi
Hardware Designers	Hardware Designers use this view to better understand potential mistakes that can be made in specific areas of their IP design. The use of concepts with which hardware designers are familiar makes it easier to navigate.
Educators	Educators use this view to teach future professionals about the types of mistakes that are commonly made in hardware design.

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
CWE Content Team	MITRE	2019-12-27 +00:00	2020-02-24 +00:00	4.0

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2022-06-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2026-10-28 +00:00	updated Other_Notes, Relationship_Notes

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.