名称: Improper Handling of Physical or Environmental Conditions

The product does not properly handle unexpected physical or environmental conditions that occur naturally or are artificially induced.

基本信息

背景详情

引入方式

Architecture and Design : The product's design might not consider checking and handling extreme conditions.
Manufacturing : For hardware manufacturing, sub-par components might be chosen that are not able to handle the expected environmental conditions.

适用平台

技术

类： System on Chip (Undetermined)
类： ICS/OT (Undetermined)

常见后果

影响范围	影响	可能性
Confidentiality Integrity Availability	Varies by Context, Unexpected State 注意： Consequences of this weakness are highly dependent on the role of affected components within the larger product.

观察示例

参考资料	描述
CVE-2019-17391	Lack of anti-glitch protections allows an attacker to launch a physical attack to bypass the secure boot and read protected eFuses.

潜在缓解措施

Phases : Requirements
In requirements, be specific about expectations for how the product will perform when it exceeds physical and environmental boundary conditions, e.g., by shutting down.
Phases : Architecture and Design // Implementation
Where possible, include independent components that can detect excess environmental conditions and have the capability to shut down the product.
Phases : Architecture and Design // Implementation
Where possible, use shielding or other materials that can increase the adversary's workload and reduce the likelihood of being able to successfully trigger a security-related failure.

漏洞映射说明

依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate
备注 : Examine children of this entry to see if there is a better fit

参考资料

REF-1248

Categories of Security Vulnerabilities in ICS
Securing Energy Infrastructure Executive Task Force (SEI ETF).
https://secureenergy.inl.gov/content/uploads/27/2024/12/SEI-ETF-NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf

REF-1255

Semi-invasive attacks - A new approach to hardware security analysis
Sergei P. Skorobogatov.
https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.pdf

REF-1285

Physical Security Attacks Against Silicon Devices
Texas Instruments.
https://www.ti.com/lit/an/swra739/swra739.pdf?ts=1644234570420

REF-1286

On The Susceptibility of Texas Instruments SimpleLink Platform Microcontrollers to Non-Invasive Physical Attacks
Lennert Wouters, Benedikt Gierlichs, Bart Preneel.
https://eprint.iacr.org/2022/328.pdf

REF-1101

The Hard-coded Key to my Heart - Hacking a Pacemaker Programmer
Anders B. Wilhelmsen, Eivind S. Kristiansen, Marie Moe.
https://anderbw.github.io/2019-08-10-DC27-Biohacking-pacemaker-programmer.pdf

提交记录

名称	组织	日期	发布日期	Version
CWE Content Team	MITRE	2022-04-21 +00:00	2022-04-28 +00:00	4.7

修改记录

名称	组织	日期	备注
CWE Content Team	MITRE	2022-06-28 +00:00	updated Description, Name, Potential_Mitigations, Relationships, Type
CWE Content Team	MITRE	2022-10-13 +00:00	updated References
CWE Content Team	MITRE	2023-01-31 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-09-09 +00:00	updated References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, References, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Background_Details, Description, Dimensions, Relationships, Technical_Nuance

CWE-1384 详情

CWE-1384