CWE-1194 Software Weakness Details | CVE Find

Produttori e prodotti

CPE, acronimo di Common Platform Enumeration, è uno schema standardizzato per nominare hardware, software e sistemi operativi. CPE fornisce uno schema di denominazione strutturato per identificare e classificare in modo univoco sistemi, piattaforme e pacchetti informatici in base ad attributi quali produttore, nome del prodotto, versione, aggiornamento, edizione e lingua.

Nome: Hardware Design

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

CWE Members

CWE-1195: Manufacturing and Life Cycle Management Concerns Categoria

CWE-1195: Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.

CWE-1059: Insufficient Technical Documentation Base

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Base

CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device Base

CWE-1269: Product Released in Non-Release Configuration Base

CWE-1273: Device Unlock Credential Sharing Base

CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors Base

CWE-1196: Security Flow Issues Categoria

CWE-1196: Weaknesses in this category are related to improper design of full-system security flows, including but not limited to secure boot, secure update, and hardware-device attestation.

CWE-1190: DMA Device Enabled Too Early in Boot Phase Base

CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control Base

CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels Base

CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code Base

CWE-1283: Mutable Attestation or Measurement Reporting Data Base

CWE-1310: Missing Ability to Patch ROM Code Base

CWE-1326: Missing Immutable Root of Trust in Hardware Base

CWE-1328: Security Version Number Mutable to Older Versions Base

CWE-1197: Integration Issues Categoria

CWE-1197: Weaknesses in this category are those that arise due to integration of multiple hardware Intellectual Property (IP) cores, from System-on-a-Chip (SoC) subsystem interactions, or from hardware platform subsystem interactions.

CWE-1276: Hardware Child Block Incorrectly Connected to Parent System Base

CWE-1198: Privilege Separation and Access Control Issues Categoria

CWE-1198: Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

CWE-276: Incorrect Default Permissions Base

CWE-441: Unintended Proxy or Intermediary Base

CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) Base

CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC) Base

CWE-1220: Insufficient Granularity of Access Control Base

CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks Base

CWE-1242: Inclusion of Undocumented Features or Chicken Bits Base

CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges Base

CWE-1262: Improper Access Control for Register Interface Base

CWE-1267: Policy Uses Obsolete Encoding Base

CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents Base

CWE-1280: Access Control Check Implemented After Asset is Accessed Base

CWE-1294: Insecure Security Identifier Mechanism Base

CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface Base

CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) Base

CWE-1303: Non-Transparent Sharing of Microarchitectural Resources Base

CWE-1314: Missing Write Protection for Parametric Data Values Base

CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses Base

CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy Base

CWE-1420: Exposure of Sensitive Information during Transient Execution Base

CWE-1199: General Circuit and Logic Design Concerns Categoria

CWE-1199: Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL.

CWE-1209: Failure to Disable Reserved Bits Base

CWE-1221: Incorrect Register Defaults or Module Parameters Base

CWE-1223: Race Condition for Write-Once Attributes Base

CWE-1224: Improper Restriction of Write-Once Bit Fields Base

CWE-1231: Improper Prevention of Lock Bit Modification Base

CWE-1232: Improper Lock Behavior After Power State Transition Base

CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection Base

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Base

CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic Base

CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State Base

CWE-1253: Incorrect Selection of Fuse Values Base

CWE-1254: Incorrect Comparison Logic Granularity Base

CWE-1261: Improper Handling of Single Event Upsets Base

CWE-1298: Hardware Logic Contains Race Conditions Base

CWE-1201: Core and Compute Issues Categoria

CWE-1201: Weaknesses in this category are typically associated with CPUs, Graphics, Vision, AI, FPGA, and microcontrollers.

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations Base

CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior Base

CWE-1342: Information Exposure through Microarchitectural State after Transient Execution Base

CWE-1420: Exposure of Sensitive Information during Transient Execution Base

CWE-1202: Memory and Storage Issues Categoria

CWE-1202: Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

CWE-226: Sensitive Information in Resource Not Removed Before Reuse Base

CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories Base

CWE-1251: Mirrored Regions with Different Values Base

CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions Base

CWE-1282: Assumed-Immutable Data is Stored in Writable Memory Base

CWE-1420: Exposure of Sensitive Information during Transient Execution Base

CWE-1203: Peripherals, On-chip Fabric, and Interface/IO Problems Categoria

CWE-1203: Weaknesses in this category are related to hardware security problems that apply to peripheral devices, IO interfaces, on-chip interconnects, network-on-chip (NoC), and buses. For example, this category includes issues related to design of hardware interconnect and/or protocols such as PCIe, USB, SMBUS, general-purpose IO pins, and user-input peripherals such as mouse and keyboard.

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge Base

CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall Base

CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point Base

CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges Base

CWE-1317: Improper Access Control in Fabric Bridge Base

CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC) Base

CWE-1205: Security Primitives and Cryptography Issues Categoria

CWE-1205: Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).

CWE-203: Observable Discrepancy Base

CWE-325: Missing Cryptographic Step Base

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation Base

CWE-1241: Use of Predictable Algorithm in Random Number Generator Base

CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready Base

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Base

CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs Base

CWE-1206: Power, Clock, Thermal, and Reset Concerns Categoria

CWE-1206: Weaknesses in this category are related to system power, voltage, current, temperature, clocks, system state saving/restoring, and resets at the platform and SoC level.

CWE-1232: Improper Lock Behavior After Power State Transition Base

CWE-1247: Improper Protection Against Voltage and Clock Glitches Base

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Base

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Base

CWE-1256: Improper Restriction of Software Interfaces to Hardware Features Base

CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings Base

CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation Base

CWE-1314: Missing Write Protection for Parametric Data Values Base

CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals Base

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Base

CWE-1338: Improper Protections Against Hardware Overheating Base

CWE-1207: Debug and Test Problems Categoria

CWE-1207: Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

CWE-1191: On-Chip Debug and Test Interface With Improper Access Control Base

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Base

CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug Base

CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State Base

CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information Base

CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition Base

CWE-1291: Public Key Re-Use for Signing both Debug and Production Code Base

CWE-1295: Debug Messages Revealing Unnecessary Information Base

CWE-1296: Incorrect Chaining or Granularity of Debug Components Base

CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime Base

CWE-1323: Improper Management of Sensitive Trace Data Base

CWE-319: Cleartext Transmission of Sensitive Information Base

CWE-1208: Cross-Cutting Problems Categoria

CWE-1208: Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

CWE-440: Expected Behavior Violation Base

CWE-1053: Missing Documentation for Design Base

CWE-1059: Insufficient Technical Documentation Base

CWE-1263: Improper Physical Access Control Base

CWE-1277: Firmware Not Updateable Base

CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component Base

CWE-1329: Reliance on Component That is Not Updateable Base

CWE-1357: Reliance on Insufficiently Trustworthy Component Base

CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface Base

CWE-1388: Physical Access Issues and Concerns Categoria

CWE-1388: Weaknesses in this category are related to concerns of physical access.

CWE-1384: Improper Handling of Physical or Environmental Conditions Base

CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) Base

CWE-1247: Improper Protection Against Voltage and Clock Glitches Base

CWE-1261: Improper Handling of Single Event Upsets Base

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Base

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Base

CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Base

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Base

CWE-1300: Improper Protection of Physical Side Channels Base

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Base

CWE View Informations

Note sulla mappatura delle vulnerabilità

Giustificazione : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Commento : Use this View or other Views to search and navigate for the appropriate weakness.

Note

This view attempts to present hardware weaknesses in a simple and intuitive way. As such it uses a single level of abstraction. The same category could contain weaknesses that have parent/child relationships within View-1000. By exploring View-1000 relationships for the weaknesses that are included, one can find deeper relationships between some hardware weaknesses.
The top level categories in this view represent commonly understood areas/terms within hardware design, and are meant to aid the user in identifying potential related weaknesses. It is possible for the same weakness to exist within multiple different categories.

Destinatari

Parti interessate	Descrizione
Hardware Designers	Hardware Designers use this view to better understand potential mistakes that can be made in specific areas of their IP design. The use of concepts with which hardware designers are familiar makes it easier to navigate.
Educators	Educators use this view to teach future professionals about the types of mistakes that are commonly made in hardware design.

Invio

Nome	Organizzazione	Data	Data di rilascio	Version
CWE Content Team	MITRE	2019-12-27 +00:00	2020-02-24 +00:00	4.0

Modifiche

Nome	Organizzazione	Data	Commento
CWE Content Team	MITRE	2022-06-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2026-10-28 +00:00	updated Other_Notes, Relationship_Notes

Le informazioni presentate su CVE Find provengono da diverse fonti di riferimento attentamente selezionate. I dati CVE sono forniti da MITRE Corporation e dal National Vulnerability Database (NVD). Il catalogo delle vulnerabilità sfruttate conosciute (KEV) proviene dalla Cybersecurity and Infrastructure Security Agency (CISA), mentre i punteggi EPSS provengono da FIRST.org. Inoltre, i dati relativi alle vulnerabilità software (CWE) e ai pattern di attacco comuni (CAPEC) sono mantenuti da MITRE Corporation, e le informazioni sulle configurazioni hardware e software (CPE) sono fornite da NVD.