1896
Scope Impact Likelihood
Hide Activities
Reduce Reliability
Quality Degradation
Reduce Maintainability
Without a method of verification, one cannot be sure that
everything only functions as expected.
Potential Mitigations
Phase: Documentation
Phase: Architecture and Design
Ensure that design documentation is detailed enough to allow for post-manufacturing verification.
Observed Examples
Reference Description
CVE-2022-3203 A wireless access point manual specifies that the only method of configuration
is via web interface (CWE-1059), but there is an undisclosed telnet server that
was activated by default (CWE-912).
https://www.cve.org/CVERecord?id=CVE-2022-3203
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1195 Manufacturing and Life Cycle Management Concerns 1194 2469
MemberOf 1208 Cross-Cutting Problems 1194 2474
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1371 ICS Supply Chain: Poorly Documented or
Undocumented Features
1358 2508
MemberOf 1375 ICS Engineering (Construction/Deployment): Gaps in
Details/Data
1358 2511
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 2-4 Req SP.02.03 BR
ISA/IEC 62443 Part 2-4 Req SP.02.03 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.03.03 RE(1)
ISA/IEC 62443 Part 4-1 Req SG-1
ISA/IEC 62443 Part 4-1 Req SG-2
ISA/IEC 62443 Part 4-1 Req SG-3
ISA/IEC 62443 Part 4-1 Req SG-4
ISA/IEC 62443 Part 4-1 Req SG-5
ISA/IEC 62443 Part 4-1 Req SG-6
ISA/IEC 62443 Part 4-1 Req SG-7
References
[REF-1248]Securing Energy Infrastructure Executive Task Force (SEI ETF). "Categories of
Security Vulnerabilities in ICS". 2022 March 9. < https://inl.gov/wp-content/uploads/2022/03/SEIETF-
NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf >.
CWE Version 4.14
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses