2117
Scope Impact Likelihood
Confidentiality
Integrity
Access Control
Authentication
Authorization
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Execute Unauthorized Code or Commands
DoS: Crash, Exit, or Restart
If an attacker can identify an exploitable vulnerability in one
device that has no means of patching, the attack may be
used against an entire class of devices.
Medium
Detection Methods
Manual Analysis
Create a new installable boot image of the current build with a minor version number change.
Use the standard installation method to update the boot image. Verify that the minor version
number has changed. Create a fake image. Verify that the boot updater will not install the fake
image and generates an "invalid image" error message or equivalent.
Effectiveness = High
Architecture or Design Review
Check the consumer or maintainer documentation, the architecture/design documentation, or
the original requirements to ensure that the documentation includes details for how to update the
firmware.
Effectiveness = Moderate
Manual Dynamic Analysis
Determine if there is a lack of a capability to update read-only memory (ROM) structure. This
could manifest as a difference between the latest firmware version and the current version within
the device.
Effectiveness = High
Potential Mitigations
Phase: Requirements
Specify requirements to include the ability to update the firmware. Include integrity checks and
authentication to ensure that untrusted firmware cannot be installed.
Phase: Architecture and Design
Design the device to allow for updating the firmware. Ensure that the design specifies how to
distribute the updates and ensure their integrity and authentication.
Phase: Implementation
Implement the necessary functionality to allow the firmware to be updated.
Demonstrative Examples
Example 1:
A refrigerator has an Internet interface for the official purpose of alerting the manufacturer when
that refrigerator detects a fault. Because the device is attached to the Internet, the refrigerator is a
target for hackers who may wish to use the device other potentially more nefarious purposes.
Example Language: Other (Bad)
The refrigerator has no means of patching and is hacked becoming a spewer of email spam.
Example Language: Other (Good)
The device automatically patches itself and provides considerable more protection against being hacked.
CWE Version 4.14
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC)
Imaging Techniques
CWE-1278: Missing Protection Against Hardware Reverse
Engineering Using Integrated Circuit (IC) Imaging Techniques 2118
Observed Examples
Reference Description
CVE-2020-9054 Chain: network-attached storage (NAS) device has a critical OS command
injection (CWE-78) vulnerability that is actively exploited to place IoT devices
into a botnet, but some products are "end-of-support" and cannot be patched
(CWE-1277). [REF-1097]
https://www.cve.org/CVERecord?id=CVE-2020-9054
[REF-1095] A hardware "smart lock" has weak key generation that allows attackers to steal
the key by BLE sniffing, but the device's firmware cannot be upgraded and
hence remains vulnerable [REF-1095].
https://www.theregister.com/2019/12/11/f_secure_keywe/
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1208 Cross-Cutting Problems 1194 2474
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
Terminology
The "firmware" term does not have a single commonly-shared definition, so there may be
variations in how this CWE entry is interpreted during mapping.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
682 Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities
References
[REF-1095]Matthew Hughes. "Bad news: KeyWe Smart Lock is easily bypassed and can't
be fixed". 2019 December 1. < https://www.theregister.com/2019/12/11/f_secure_keywe/
>.2023-04-07.
[REF-1096]Alex Scroxton. "Alarm bells ring, the IoT is listening". < https://
www.computerweekly.com/news/252475324/Alarm-bells-ring-the-IoT-is-listening >.
[REF-1097]Brian Krebs. "Zyxel Flaw Powers New Mirai IoT Botnet Strain". 2020 March 0. < https://
krebsonsecurity.com/2020/03/zxyel-flaw-powers-new-mirai-iot-botnet-strain/ >.
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using
Integrated Circuit (IC) Imaging Techniques
Weakness ID : 1278
Structure : Simple
Abstraction : Base
Description
Information stored in hardware may be recovered by an attacker with the capability to capture and
analyze images of the integrated circuit using techniques such as scanning electron microscopy.
Extended Description
CWE Version 4.14
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC)
Imaging Techniques
CWE-1278: Missing Protection Against Hardware Reverse
Engineering Using Integrated Circuit (IC) Imaging Techniques