Detail CWE-1273

CWE-1273

Device Unlock Credential Sharing
2020-02-24
00h00 +00:00
Incomplete
2025-12-11
00h00 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Device Unlock Credential Sharing

The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.

Informasi Umum

Mode Pengenalan

Integration
Manufacturing

Platform yang Berlaku

Bahasa

Nama: VHDL (Undetermined)
Nama: Verilog (Undetermined)
Kelas: Compiled (Undetermined)

Sistem Operasi

Kelas: Not OS-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Nama: Other (Undetermined)
Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
Confidentiality
Integrity
Availability
Access Control
Accountability
Authentication
Authorization
Non-Repudiation		Modify Memory, Read Memory, Modify Files or Directories, Read Files or Directories, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism

Catatan: Once unlock credentials are compromised, an attacker can use the credentials to unlock the device and gain unauthorized access to the hidden functionalities protected by those credentials.

Mitigasi yang Memungkinkan

Phases : Integration
Ensure the unlock credentials are shared with the minimum number of parties and with utmost secrecy. To limit the risk associated with compromised credentials, where possible, the credentials should be part-specific.
Phases : Manufacturing
Ensure the unlock credentials are shared with the minimum number of parties and with utmost secrecy. To limit the risk associated with compromised credentials, where possible, the credentials should be part-specific.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

CAPEC ID Nama Pola Serangan
CAPEC-560 Use of Known Domain Credentials

Catatan

This entry is still under development and will continue to see updates and content improvements.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
Parbati Kumar Manna, Hareesh Khattri, Arun Kanuparthi Intel Corporation 2020-05-29 +00:00 2020-02-24 +00:00 4.1

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2020-08-20 +00:00 updated Demonstrative_Examples, Description, Related_Attack_Patterns
CWE Content Team MITRE 2021-10-28 +00:00 updated Demonstrative_Examples, Description
CWE Content Team MITRE 2022-10-13 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-04-03 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.