2219
CAPEC-ID Attack Pattern Name
176 Configuration/Environment Manipulation
CWE-1329: Reliance on Component That is Not Updateable
Weakness ID : 1329
Structure : Simple
Abstraction : Base
Description
The product contains a component that cannot be updated or patched in order to remove
vulnerabilities or significant bugs.
Extended Description
If the component is discovered to contain a vulnerability or critical bug, but the issue cannot be
fixed using an update or patch, then the product's owner will not be able to protect against the
issue. The only option might be replacement of the product, which could be too financially or
operationally expensive for the product owner. As a result, the inability to patch or update can
leave the product open to attacker exploitation or critical operation failures. This weakness can be
especially difficult to manage when using ROM, firmware, or similar components that traditionally
have had limited or no update capabilities.
In industries such as healthcare, "legacy" devices can be operated for decades. As a US task
force report [REF-1197] notes, "the inability to update or replace equipment has both large and
small health care delivery organizations struggle with numerous unsupported legacy systems that
cannot easily be replaced (hardware, software, and operating systems) with large numbers of
vulnerabilities and few modern countermeasures."
While hardware can be prone to this weakness, software systems can also be affected, such as
when a third-party driver or library is no longer actively maintained or supported but is still critical
for the required functionality.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 664 Improper Control of a Resource Through its Lifetime 1454
ChildOf 1357 Reliance on Insufficiently Trustworthy Component 2254
ParentOf 1277 Firmware Not Updateable 2116
ParentOf 1310 Missing Ability to Patch ROM Code 2179
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-1329: Reliance on Component That is Not Updateable
CWE-1329: Reliance on Component That is Not Updateable