2258
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Varies by Context
Unexpected State
Consequences of this weakness are highly dependent on
the role of affected components within the larger product.
Potential Mitigations
Phase: Requirements
In requirements, be specific about expectations for how the product will perform when it exceeds
physical and environmental boundary conditions, e.g., by shutting down.
Phase: Architecture and Design
Phase: Implementation
Where possible, include independent components that can detect excess environmental
conditions and have the capability to shut down the product.
Phase: Architecture and Design
Phase: Implementation
Where possible, use shielding or other materials that can increase the adversary's workload and
reduce the likelihood of being able to successfully trigger a security-related failure.
Observed Examples
Reference Description
CVE-2019-17391 Lack of anti-glitch protections allows an attacker to launch a physical attack to
bypass the secure boot and read protected eFuses.
https://www.cve.org/CVERecord?id=CVE-2019-17391
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1367 ICS Dependencies (& Architecture): External Physical
Systems
1358 2504
MemberOf 1388 Physical Access Issues and Concerns 1194 2518
MemberOf 1405 Comprehensive Categorization: Improper Check or
Handling of Exceptional Conditions
1400 2531
References
[REF-1248]Securing Energy Infrastructure Executive Task Force (SEI ETF). "Categories of
Security Vulnerabilities in ICS". 2022 March 9. < https://inl.gov/wp-content/uploads/2022/03/SEIETF-
NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf >.
[REF-1255]Sergei P. Skorobogatov. "Semi-invasive attacks - A new approach to hardware security
analysis". 2005 April. < https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.pdf >.
[REF-1285]Texas Instruments. "Physical Security Attacks Against Silicon Devices". 2022 January
1. < https://www.ti.com/lit/an/swra739/swra739.pdf?ts=1644234570420 >.
[REF-1286]Lennert Wouters, Benedikt Gierlichs and Bart Preneel. "On The Susceptibility of Texas
Instruments SimpleLink Platform Microcontrollers to Non-Invasive Physical Attacks". 2022 March 4.
< https://eprint.iacr.org/2022/328.pdf >.
CWE Version 4.14
CWE-1385: Missing Origin Validation in WebSockets
CWE-1385: Missing Origin Validation in WebSockets