CWE-1059
Insufficient Technical Documentation
Incomplete
2019-01-03
00h00 +00:00
00h00 +00:00
2025-09-09
00h00 +00:00
00h00 +00:00
Notifiche per un CWE specifico
Rimani informato su qualsiasi modifica relativa a un CWE specifico.
Nome: Insufficient Technical Documentation
The product does not contain sufficient
technical or engineering documentation (whether on paper or
in electronic form) that contains descriptions of all the
relevant software/hardware elements of the product, such as
its usage, structure, architectural components, interfaces, design, implementation,
configuration, operation, etc.
General Informations
Modes Of Introduction
Architecture and DesignDocumentation
Piattaforme applicabili
Linguaggio
Class: Not Language-Specific (Undetermined)Sistemi operativi
Class: Not OS-Specific (Undetermined)Architetture
Class: Not Architecture-Specific (Undetermined)Tecnologie
Class: Not Technology-Specific (Undetermined)Class: ICS/OT (Undetermined)
Conseguenze comuni
| Ambito | Impatto | Probabilità |
|---|---|---|
| Other | Varies by Context, Hide Activities, Reduce Reliability, Quality Degradation, Reduce Maintainability Note: Without a method of verification, one cannot be sure that everything only functions as expected. |
Esempi osservati
| Riferimenti | Descrizione |
|---|---|
CVE-2022-3203 | A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912). |
Potential Mitigations
Phases : Documentation // Architecture and DesignEnsure that design documentation is detailed enough to allow for post-manufacturing verification.
Note sulla mappatura delle vulnerabilità
Giustificazione : This entry is primarily a quality issue with no direct security implications.Commento : Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.
Riferimenti
REF-1248
Categories of Security Vulnerabilities in ICSSecuring Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf
REF-1254
Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions Draft Guidance for Industry and Food and Drug Administration Staff (DRAFT GUIDANCE)FDA.
https://www.fda.gov/media/119933/download
Invio
| Nome | Organizzazione | Data | Data di rilascio | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 3.2 |
Modifiche
| Nome | Organizzazione | Data | Commento |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, References, Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Mapping_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated References |
