이름: ICS Communications: Frail Security in Protocols

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CWE 구성원 목록

CWE-121: Stack-based Buffer Overflow 기본

CWE-125: Out-of-bounds Read 기본

CWE-268: Privilege Chaining 기본

CWE-269: Improper Privilege Management 기본

CWE-276: Incorrect Default Permissions 기본

CWE-290: Authentication Bypass by Spoofing 기본

CWE-306: Missing Authentication for Critical Functionality 기본

CWE-311: Missing Encryption of Sensitive Data 기본

CWE-312: Cleartext Storage of Sensitive Information 기본

CWE-319: Cleartext Transmission of Sensitive Information 기본

CWE-325: Missing Cryptographic Step 기본

CWE-327: Use of a Broken or Risky Cryptographic Algorithm 기본

CWE-330: Use of Insufficiently Random Values 기본

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 기본

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 기본

CWE-341: Predictable from Observable State 기본

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data 기본

CWE-358: Improperly Implemented Security Check for Standard 기본

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 기본

CWE-377: DEPRECATED: Insecure Temporary File 기본

CWE-384: Session Fixation 기본

CWE-648: Incorrect Use of Privileged APIs 기본

CWE-787: Out-of-bounds Write 기본

CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) 기본

CWE-1303: Non-Transparent Sharing of Microarchitectural Resources 기본

CWE-1393: Use of Default Password 기본

CWE 정보

취약점 매핑 메모

근거 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
댓글 : See member weaknesses of this category.

제출

이름	조직	날짜	출시일	Version
New Categories of Security Vulnerabilities (NCSV) Technical Project Team (TPT)	Securing Energy Infrastructure Executive Task Force	2022-03-09 +00:00	2022-04-28 +00:00	4.7

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description, Maintenance_Notes, Relationship_Notes
CWE Content Team	MITRE	2023-04-27 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2025-09-09 +00:00	updated References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Maintenance_Notes

참고 자료

REF-1259

Transport Layer Security
Wikipedia.
https://en.wikipedia.org/wiki/Transport_Layer_Security

REF-1248

Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf

CWE-1366 카테고리 상세 정보

CWE-1366