The software CWE Top-25 leverages CVE® data within the NIST National Vulnerability Database (NVD) for a data-driven approach that considers weakness type frequency and severity. This is not possible in the hardware domain primarily because there are limited associations of HW CWEs with CVEs due to the HW CWE's infancy. Recently, the CVE program has been working to issue CVE records for hardware vulnerabilities. While post-release hardware vulnerabilities are far less frequent than that of software, as more hardware vulnerability data is readily available, the CWE Hardware List methodology will potentially change.
Acknowledgments
The 2021 CWE Hardware team includes (in alphabetical order by last name): John Butterworth, Steve Christey Coley, Kerry Crouse, Christina Johns, Gananand Kini, Chris Lathrop, Luke Malinowski, and Alec Summers.
Also, tremendous thanks go to the HW CWE SIG membership, which includes at the time of publication (in alphabetical order by first name):