2033
CWE-1242: Inclusion of Undocumented Features or Chicken Bits
Weakness ID : 1242
Structure : Simple
Abstraction : Base
Description
The device includes chicken bits or undocumented features that can create entry points for
unauthorized actors.
Extended Description
A common design practice is to use undocumented bits on a device that can be used to disable
certain functional security features. These bits are commonly referred to as "chicken bits". They
can facilitate quick identification and isolation of faulty components, features that negatively affect
performance, or features that do not provide the required controllability for debug and test. Another
way to achieve this is through implementation of undocumented features. An attacker might exploit
these interfaces for unauthorized access.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Modify Memory
Read Memory
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
The implementation of chicken bits in a released product is highly discouraged. If implemented
at all, ensure that they are disabled in production devices. All interfaces to a device should be
documented.
Effectiveness = High
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-1242: Inclusion of Undocumented Features or Chicken Bits
CWE-1242: Inclusion of Undocumented Features or Chicken Bits