CWE-1273
Device Unlock Credential Sharing
2020-02-24
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Device Unlock Credential Sharing
The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.
일반 정보
취약점 도입 방식
IntegrationManufacturing
적용 가능한 플랫폼
언어
이름: VHDL (Undetermined)이름: Verilog (Undetermined)
클래스: Compiled (Undetermined)
운영 체제
클래스: Not OS-Specific (Undetermined)아키텍처
클래스: Not Architecture-Specific (Undetermined)기술
이름: Other (Undetermined)클래스: Not Technology-Specific (Undetermined)
일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Confidentiality Integrity Availability Access Control Accountability Authentication Authorization Non-Repudiation | Modify Memory, Read Memory, Modify Files or Directories, Read Files or Directories, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism 참고: Once unlock credentials are compromised, an attacker can use the credentials to unlock the device and gain unauthorized access to the hidden functionalities protected by those credentials. |
잠재적 완화 방법
Phases : IntegrationEnsure the unlock credentials are shared with the minimum number of parties and with utmost secrecy. To limit the risk associated with compromised credentials, where possible, the credentials should be part-specific.
Phases : Manufacturing
Ensure the unlock credentials are shared with the minimum number of parties and with utmost secrecy. To limit the risk associated with compromised credentials, where possible, the credentials should be part-specific.
취약점 매핑 메모
근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
관련 공격 패턴
| CAPEC ID | 공격 패턴 이름 |
|---|---|
| CAPEC-560 | Use of Known Domain Credentials
|
메모
This entry is still under development and will continue to see updates and content improvements.제출
| 이름 | 조직 | 날짜 | 출시일 | Version |
|---|---|---|---|---|
| Parbati Kumar Manna, Hareesh Khattri, Arun Kanuparthi | Intel Corporation | 4.1 |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities |
