2280
[REF-1320]Ali Youssef. "A Framework for a Medical Device Security Program at a Healthcare
Delivery Organization". 2022 August 8. < https://array.aami.org/content/news/framework-medicaldevice-
security-program-healthcare-delivery-organization >.2023-04-07.
[REF-1321]Cloud Security Alliance. "Shared Responsibility Model Explained". 2020 August
6. < https://cloudsecurityalliance.org/blog/2020/08/26/shared-responsibility-model-explained/
>.2023-01-28.
[REF-1322]Melissa Chase, Steven Christey Coley, Julie Connolly, Ronnie Daldos, Margie Zuk.
"Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook". 2022
November 4. < https://www.mitre.org/news-insights/publication/medical-device-cybersecurityregional-
incident-preparedness-and-response >.2023-01-28.
CWE-1419: Incorrect Initialization of Resource
Weakness ID : 1419
Structure : Simple
Abstraction : Class
Description
The product attempts to initialize a resource but does not correctly do so, which might leave the
resource in an unexpected, incorrect, or insecure state when it is accessed.
Extended Description
This can have security implications when the associated resource is expected to have certain
properties or values. Examples include a variable that determines whether a user has been
authenticated or not, or a register or fuse value that determines the security state of the product.
For software, this weakness can frequently occur when implicit initialization is used, meaning the
resource is not explicitly set to a specific value. For example, in C, memory is not necessarily
cleared when it is allocated on the stack, and many scripting languages use a default empty, null
value, or zero value when a variable is not explicitly initialized.
For hardware, this weakness frequently appears with reset values and fuses. After a product reset,
hardware may initialize registers incorrectly. During different phases of a product lifecycle, fuses
may be set to incorrect values. Even if fuses are set to correct values, the lines to the fuse could be
broken or there might be hardware on the fuse line that alters the fuse value to be incorrect.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 665 Improper Initialization 1456
ParentOf 454 External Initialization of Trusted Variables or Data Stores 1085
ParentOf 1051 Initialization with Hard-Coded Network Resource
Configuration Data