1895
Abstraction : Class
Description
The product does not contain sufficient technical or engineering documentation (whether on
paper or in electronic form) that contains descriptions of all the relevant software/hardware
elements of the product, such as its usage, structure, architectural components, interfaces, design,
implementation, configuration, operation, etc.
Extended Description
When technical documentation is limited or lacking, products are more difficult to maintain.
This indirectly affects security by making it more difficult or time-consuming to find and/or fix
vulnerabilities.
When using time-limited or labor-limited third-party/in-house security consulting services (such
as threat modeling, vulnerability discovery, or pentesting), insufficient documentation can force
those consultants to invest unnecessary time in learning how the product is organized, instead of
focusing their expertise on finding the flaws or suggesting effective mitigations.
With respect to hardware design, the lack of a formal, final manufacturer reference can make it
difficult or impossible to evaluate the final product, including post-manufacture verification. One
cannot ensure that design functionality or operation is within acceptable tolerances, conforms to
specifications, and is free from unexpected behavior. Hardware-related documentation may include
engineering artifacts such as hardware description language (HDLs), netlists, Gerber files, Bills of
Materials, EDA (Electronic Design Automation) tool files, etc.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
ParentOf 1053 Missing Documentation for Design 1888
ParentOf 1110 Incomplete Design Documentation 1950
ParentOf 1111 Incomplete I/O Documentation 1951
ParentOf 1112 Incomplete Documentation of Program Execution 1952
ParentOf 1118 Insufficient Documentation of Error Handling Techniques 1958
Weakness Ordinalities
Indirect :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
CWE Version 4.14
CWE-1059: Insufficient Technical Documentation
CWE-1059: Insufficient Technical Documentation