2256
Continue to monitor changes in each of the product's components, especially when the changes
indicate new vulnerabilities, end-of-life (EOL) plans, supplier practices that affect trustworthiness,
etc.
Observed Examples
Reference Description
CVE-2020-9054 Chain: network-attached storage (NAS) device has a critical OS command
injection (CWE-78) vulnerability that is actively exploited to place IoT devices
into a botnet, but some products are "end-of-support" and cannot be patched
(CWE-1277). [REF-1097]
https://www.cve.org/CVERecord?id=CVE-2020-9054
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1208 Cross-Cutting Problems 1194 2474
MemberOf 1367 ICS Dependencies (& Architecture): External Physical
Systems
1358 2504
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1370 ICS Supply Chain: Common Mode Frailties 1358 2507
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Maintenance
As of CWE 4.10, the name and description for this entry has undergone significant change and is
still under public discussion, especially by members of the HW SIG.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 2-4 Req SP.03.02 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.03.02 RE(2)
ISA/IEC 62443 Part 3-3 Req SR 1.13
ISA/IEC 62443 Part 4-2 Req EDR 3.12
ISA/IEC 62443 Part 4-2 Req HDR 3.12
ISA/IEC 62443 Part 4-2 Req NDR 3.12
ISA/IEC 62443 Part 4-2 Req EDR 3.13
ISA/IEC 62443 Part 4-2 Req HDR 3.13
ISA/IEC 62443 Part 4-2 Req NDR 3.13
ISA/IEC 62443 Part 4-2 Req CR-7.8
ISA/IEC 62443 Part 4-1 Req SM-6
ISA/IEC 62443 Part 4-1 Req SM-9
ISA/IEC 62443 Part 4-1 Req SM-10
References
[REF-1212]"A06:2021 - Vulnerable and Outdated Components". 2021 September 4. OWASP. <
https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/ >.
[REF-1246]National Telecommunications and Information Administration. "SOFTWARE BILL OF
MATERIALS". < https://ntia.gov/page/software-bill-materials >.2023-04-07.
[REF-1247]NTIA Multistakeholder Process on Software Component Transparency Framing
Working Group. "Framing Software Component Transparency: Establishing a Common Software
CWE Version 4.14
CWE-1384: Improper Handling of Physical or Environmental Conditions
CWE-1384: Improper Handling of Physical or Environmental Conditions