2100
Example Language: (Bad)
Suppose the chipmaker has a way of scanning all the internal memory (containing chipmaker-level secrets) during the
manufacturing phase, and the way the chipmaker or the Original Equipment Manufacturer (OEM) marks the end of the
manufacturing phase is by blowing a Manufacturing Complete fuse. Now, suppose that whoever blows the Manufacturing
Complete fuse inadvertently forgets to execute the step to blow the fuse.
An attacker will now be able to scan all the internal memory (containing chipmaker-level secrets).
Example Language: (Good)
Blow the Manufacturing Complete fuse.
Observed Examples
Reference Description
CVE-2019-13945 Regarding SSA-686531, a hardware based manufacturing access on S7-1200
and S7-200 SMART has occurred. A vulnerability has been identified in
SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC
S7-200 SMART CPU family (All versions). There is an access mode used
during manufacturing of S7-1200 CPUs that allows additional diagnostic
functionality. The security vulnerability could be exploited by an attacker with
physical access to the UART interface during boot process. At the time of
advisory publication, no public exploitation of this security vulnerability was
known.
https://www.cve.org/CVERecord?id=CVE-2019-13945
CVE-2018-4251 Laptops with Intel chipsets were found to be running in Manufacturing
Mode. After this information was reported to the OEM, the vulnerability
(CVE-2018-4251) was patched disallowing access to the interface.
https://www.cve.org/CVERecord?id=CVE-2018-4251
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1195 Manufacturing and Life Cycle Management Concerns 1194 2469
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Related Attack Patterns
CAPEC-ID Attack Pattern Name
439 Manipulation During Distribution
References
[REF-1103]Lucian Armasu. "Intel ME's Undocumented Manufacturing Mode Suggests CPU
Hacking Risks". 2018 October 3. < https://www.tomshardware.com/news/intel-me-cpuundocumented-
manufacturing-mode,37883.html >.
CWE-1270: Generation of Incorrect Security Tokens
Weakness ID : 1270
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-1270: Generation of Incorrect Security Tokens
CWE-1270: Generation of Incorrect Security Tokens