2255
the product vendor, such as a software component whose source code is lost and was built by
developers who left the company, or a component that was developed by a separate company that
was acquired and brought into the product's own company.
Note that there can be disagreement as to whether a component is sufficiently trustworthy, since
trust is ultimately subjective. Different stakeholders (e.g., customers, vendors, governments) have
various threat models and ways to assess trust, and design/architecture choices might make
tradeoffs between security, reliability, safety, privacy, cost, and other characteristics.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
ParentOf 1104 Use of Unmaintained Third Party Components 1944
ParentOf 1329 Reliance on Component That is Not Updateable 2219
Weakness Ordinalities
Indirect :
Applicable Platforms
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Reduce Maintainability
Potential Mitigations
Phase: Requirements
Phase: Architecture and Design
Phase: Implementation
For each component, ensure that its supply chain is well-controlled with sub-tier suppliers using
best practices. For third-party software components such as libraries, ensure that they are
developed and actively maintained by reputable vendors.
Phase: Architecture and Design
Phase: Implementation
Phase: Integration
Phase: Manufacturing
Maintain a Bill of Materials for all components and sub-components of the product. For software,
maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal,
machine-readable inventory of software components and dependencies, information about those
components, and their hierarchical relationships."
Phase: Operation
Phase: Patching and Maintenance
CWE Version 4.14
CWE-1357: Reliance on Insufficiently Trustworthy Component
CWE-1357: Reliance on Insufficiently Trustworthy Component