Detail Kategori CWE-1366

CWE-1366

ICS Communications: Frail Security in Protocols
2022-04-28 +00:00
Incomplete
2025-12-11 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: ICS Communications: Frail Security in Protocols

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Daftar Anggota CWE

CWE-121: Stack-based Buffer Overflow Dasar

CWE-125: Out-of-bounds Read Dasar

CWE-268: Privilege Chaining Dasar

CWE-269: Improper Privilege Management Dasar

CWE-276: Incorrect Default Permissions Dasar

CWE-290: Authentication Bypass by Spoofing Dasar

CWE-306: Missing Authentication for Critical Functionality Dasar

CWE-311: Missing Encryption of Sensitive Data Dasar

CWE-312: Cleartext Storage of Sensitive Information Dasar

CWE-319: Cleartext Transmission of Sensitive Information Dasar

CWE-325: Missing Cryptographic Step Dasar

CWE-327: Use of a Broken or Risky Cryptographic Algorithm Dasar

CWE-330: Use of Insufficiently Random Values Dasar

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Dasar

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Dasar

CWE-341: Predictable from Observable State Dasar

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Dasar

CWE-358: Improperly Implemented Security Check for Standard Dasar

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Dasar

CWE-377: DEPRECATED: Insecure Temporary File Dasar

CWE-384: Session Fixation Dasar

CWE-648: Incorrect Use of Privileged APIs Dasar

CWE-787: Out-of-bounds Write Dasar

CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) Dasar

CWE-1303: Non-Transparent Sharing of Microarchitectural Resources Dasar

CWE-1393: Use of Default Password Dasar

Informasi CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
Komentar : See member weaknesses of this category.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
New Categories of Security Vulnerabilities (NCSV) Technical Project Team (TPT) Securing Energy Infrastructure Executive Task Force 2022-03-09 +00:00 2022-04-28 +00:00 4.7

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2023-01-31 +00:00 updated Description, Maintenance_Notes, Relationship_Notes
CWE Content Team MITRE 2023-04-27 +00:00 updated Mapping_Notes, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes, Relationships
CWE Content Team MITRE 2025-09-09 +00:00 updated References
CWE Content Team MITRE 2025-12-11 +00:00 updated Maintenance_Notes

Referensi

REF-1259

Transport Layer Security
Wikipedia.
https://en.wikipedia.org/wiki/Transport_Layer_Security

REF-1248

Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.