2106
After the transition to state B, even though the private keys are no longer accessible directly from
the fuses in state B, they can be accessed indirectly by reading the memory that contains the
private keys.
Example Language: (Good)
For transition from state A to state B, remove information which should not be available once the transition is complete.
Observed Examples
Reference Description
CVE-2020-12926 Product software does not set a flag as per TPM specifications, thereby
preventing a failed authorization attempt from being recorded after a loss of
power.
https://www.cve.org/CVERecord?id=CVE-2020-12926
Functional Areas
• Power
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
150 Collect Data from Common Resource Locations
545 Pull Data from System Resources
546 Incomplete Data Deletion in a Multi-Tenant Environment
References
[REF-1220]Zhenyu Ning and Fengwei Zhang. "Understanding the Security of ARM Debugging
Features". 2019 IEEE Symposium on Security and Privacy (SP). 2019 May 2. < https://
www.computer.org/csdl/proceedings-article/sp/2019/666000b156/19skgcwSgsE >.2023-04-07.
CWE-1273: Device Unlock Credential Sharing
Weakness ID : 1273
Structure : Simple
Abstraction : Base
Description
The credentials necessary for unlocking a device are shared across multiple parties and may
expose sensitive information.
Extended Description
"Unlocking a device" often means activating certain unadvertised debug and manufacturer-specific
capabilities of a device using sensitive credentials. Unlocking a device might be necessary for the
CWE Version 4.14
CWE-1273: Device Unlock Credential Sharing
CWE-1273: Device Unlock Credential Sharing