Nama: Insufficient or Incomplete Data Removal within Hardware Component

The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.

Informasi Umum

Mode Pengenalan

Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Sistem Operasi

Kelas: Not OS-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Confidentiality	Read Memory, Read Application Data

Contoh yang Diamati

Referensi	Deskripsi
CVE-2019-8575	Firmware Data Deletion Vulnerability in which a base station factory reset might not delete all user information. The impact of this enables a new owner of a used device that has been "factory-default reset" with a vulnerable firmware version can still retrieve, at least, the previous owner's wireless network name, and the previous owner's wireless security (such as WPA2) key. This issue was addressed with improved, data deletion.

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Apply blinding or masking techniques to implementations of cryptographic algorithms.
Phases : Implementation
Alter the method of erasure, add protection of media, or destroy the media to protect the data.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

CAPEC ID	Nama Pola Serangan
CAPEC-37	Retrieve Embedded Sensitive Data An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

Catatan

This entry is still under development and will continue to see updates and content improvements.

Referensi

REF-1117

Introduction to differential power analysis and related attacks
Paul Kocher, Joshua Jaffe, Benjamin Jun.
https://www.rambus.com/wp-content/uploads/2015/08/DPATechInfo.pdf

REF-1118

The EM Side-Channel(s)
Dakshi Agrawal, Bruce Archambeault, Josyula R. Rao, Pankaj Rohatgi.
https://link.springer.com/content/pdf/10.1007/3-540-36400-5_4.pdf

REF-1119

RSA key extraction via low-bandwidth acoustic cryptanalysis
Daniel Genkin, Adi Shamir, Eran Tromer.
https://www.iacr.org/archive/crypto2014/86160149/86160149.pdf

REF-1120

Power Analysis for Cheapskates
Colin O'Flynn.
https://media.blackhat.com/eu-13/briefings/OFlynn/bh-eu-13-for-cheapstakes-oflynn-wp.pdf

REF-1055

Data Remanence in Semiconductor Devices
Peter Gutmann.
https://www.usenix.org/legacy/events/sec01/full_papers/gutmann/gutmann.pdf

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Nicole Fern	Cycuity (originally submitted as Tortuga Logic)	2020-05-29 +00:00	2020-08-20 +00:00	4.2

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2020-12-10 +00:00	updated Relationships
CWE Content Team	MITRE	2021-07-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2021-10-28 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Relationships

Detail CWE-1301

CWE-1301