Produttori e prodotti

CPE, acronimo di Common Platform Enumeration, è uno schema standardizzato per nominare hardware, software e sistemi operativi. CPE fornisce uno schema di denominazione strutturato per identificare e classificare in modo univoco sistemi, piattaforme e pacchetti informatici in base ad attributi quali produttore, nome del prodotto, versione, aggiornamento, edizione e lingua.

Nome: Insufficient Technical Documentation

The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all of the relevant software/hardware elements of the product.

General Informations

Modes Of Introduction

Architecture and Design
Documentation

Piattaforme applicabili

Linguaggio

Classe: Not Language-Specific (Undetermined)

Sistemi operativi

Classe: Not OS-Specific (Undetermined)

Architetture

Classe: Not Architecture-Specific (Undetermined)

Tecnologie

Classe: Not Technology-Specific (Undetermined)
Classe: ICS/OT (Undetermined)

Conseguenze comuni

Ambito	Impatto	Probabilità
Other	Varies by Context, Hide Activities, Reduce Reliability, Quality Degradation, Reduce Maintainability

Esempi osservati

Riferimenti	Descrizione
CVE-2022-3203	A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).

Potential Mitigations

Phases : Documentation // Architecture and Design
Ensure that design documentation is detailed enough to allow for post-manufacturing verification.

Note sulla mappatura delle vulnerabilità

Giustificazione : This entry is primarily a quality issue with no direct security implications.
Commento : Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

Riferimenti

REF-1248

Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf

REF-1254

Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions Draft Guidance for Industry and Food and Drug Administration Staff (DRAFT GUIDANCE)
FDA.
https://www.fda.gov/media/119933/download

Invio

Nome	Organizzazione	Data	Data di rilascio	Version
CWE Content Team	MITRE	2018-07-02 +00:00	2019-01-03 +00:00	3.2

Modifiche

Nome	Organizzazione	Data	Commento
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2022-04-28 +00:00	updated Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, References, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-01-31 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated References
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Technical_Nuance

Le informazioni presentate su CVE Find provengono da diverse fonti di riferimento attentamente selezionate. I dati CVE sono forniti da MITRE Corporation e dal National Vulnerability Database (NVD). Il catalogo delle vulnerabilità sfruttate conosciute (KEV) proviene dalla Cybersecurity and Infrastructure Security Agency (CISA), mentre i punteggi EPSS provengono da FIRST.org. Inoltre, i dati relativi alle vulnerabilità software (CWE) e ai pattern di attacco comuni (CAPEC) sono mantenuti da MITRE Corporation, e le informazioni sulle configurazioni hardware e software (CPE) sono fornite da NVD.

CWE-1059 Detail

CWE-1059