| Impact | Details |
|---|---|
|
Other |
Scope: Other |
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Pillar Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 710 | Improper Adherence to Coding Standards |
| ParentOf | Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 250 | Execution with Unnecessary Privileges |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 636 | Not Failing Securely ('Failing Open') |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 638 | Not Using Complete Mediation |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 653 | Improper Isolation or Compartmentalization |
| ParentOf | Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 654 | Reliance on a Single Factor in a Security Decision |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 655 | Insufficient Psychological Acceptability |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 656 | Reliance on Security Through Obscurity |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 671 | Lack of Administrator Control over Security |
| ParentOf | Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1192 | Improper Identifier for IP Block used in System-On-Chip (SOC) |
| ParentOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1395 | Dependency on Vulnerable Third-Party Component |
| Phase | Note |
|---|---|
| Architecture and Design | |
| Implementation | |
| Operation |
Example 1
Switches may revert their functionality to that of hubs when the table used to map ARP information to the switch interface overflows, such as when under a spoofing attack. This results in traffic being broadcast to an eavesdropper, instead of being sent only on the relevant switch interface. To mitigate this type of problem, the developer could limit the number of ARP entries that can be recorded for a given switch interface, while other interfaces may keep functioning normally. Configuration options can be provided on the appropriate actions to be taken in case of a detected failure, but safe defaults should be used.
Example 2
The IPSEC specification is complex, which resulted in bugs, partial implementations, and incompatibilities between vendors.
Example 3
When executable library files are used on web servers, which is common in PHP applications, the developer might perform an access check in any user-facing executable, and omit the access check from the library file itself. By directly requesting the library file (CWE-425), an attacker can bypass this access check.
Example 4
Single sign-on technology is intended to make it easier for users to access multiple resources or domains without having to authenticate each time. While this is highly convenient for the user and attempts to address problems with psychological acceptability, it also means that a compromise of a user's credentials can provide immediate access to all other resources or domains.
Example 5
The design of TCP relies on the secrecy of Initial Sequence Numbers (ISNs), as originally covered in CVE-1999-0077 [REF-542]. If ISNs can be guessed (due to predictability, CWE-330) or sniffed (due to lack of encryption during transmission, CWE-312), then an attacker can hijack or spoof connections. Many TCP implementations have had variations of this problem over the years, including CVE-2004-0641, CVE-2002-1463, CVE-2001-0751, CVE-2001-0328, CVE-2001-0288, CVE-2001-0163, CVE-2001-0162, CVE-2000-0916, and CVE-2000-0328.
Example 6
The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK) were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were used by many products such as medical devices, Smart Home devices, wearables, and other IoT devices. [REF-1314] [REF-1315]
Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.
| Reference | Description |
|---|---|
|
Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].
|
|
|
The failure of connection attempts in a web browser resets DNS pin restrictions. An attacker can then bypass the same origin policy by rebinding a domain name to a different IP address. This was an attempt to "fail functional."
|
|
|
Hard-coded cryptographic key stored in executable program.
|
|
|
Server does not properly validate client certificates when reusing cached connections.
|
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 975 | SFP Secondary Cluster: Architecture |
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1418 | Comprehensive Categorization: Violation of Secure Design Principles |
Rationale
This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriateComments
Examine children of this entry to see if there is a better fitMaintenance
| Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|---|---|---|
| ISA/IEC 62443 | Part 4-1 | Req SD-3 | |
| ISA/IEC 62443 | Part 4-1 | Req SD-4 | |
| ISA/IEC 62443 | Part 4-1 | Req SI-1 |
| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2008年01月30日
(CWE Draft 8, 2008年01月30日) |
CWE Community | |
| Submitted by members of the CWE community to extend early CWE versions | ||
| Contributions | ||
| Contribution Date | Contributor | Organization |
|
2023年01月24日
(CWE 4.10, 2023年01月31日) |
"Mapping CWE to 62443" Sub-Working Group | CWE-CAPEC ICS/OT SIG |
| Suggested mappings to ISA/IEC 62443. | ||
| Modifications | ||
| Modification Date | Modifier | Organization |
|
2025年09月09日
(CWE 4.18, 2025年09月09日) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples, References | ||
|
2024年02月29日
(CWE 4.14, 2024年02月29日) |
CWE Content Team | MITRE |
| updated Mapping_Notes | ||
| 2023年10月26日 | CWE Content Team | MITRE |
| updated Demonstrative_Examples, Observed_Examples, References | ||
| 2023年06月29日 | CWE Content Team | MITRE |
| updated Mapping_Notes | ||
| 2023年04月27日 | CWE Content Team | MITRE |
| updated References, Relationships | ||
| 2023年01月31日 | CWE Content Team | MITRE |
| updated Maintenance_Notes, Relationships, Taxonomy_Mappings | ||
| 2022年10月13日 | CWE Content Team | MITRE |
| updated References | ||
| 2021年10月28日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2020年02月24日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2017年01月19日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2014年07月30日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2012年05月11日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2011年06月01日 | CWE Content Team | MITRE |
| updated Common_Consequences | ||
| 2008年09月08日 | CWE Content Team | MITRE |
| updated Description, Relationships | ||
| 2008年07月01日 | Eric Dalci | Cigital |
| updated Time_of_Introduction | ||
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.