745
Example 2:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors did not use any authentication for critical functionality in their OT products.
Example 3:
In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web
Service (AWS) Simple Storage Service (S3) buckets.
Example Language: Other (Bad)
A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data
unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses,
phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]
While it was not publicly disclosed how the data was protected after discovery, multiple options
could have been considered.
Example Language: Other (Good)
The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by
enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have
been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucketserver-
side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked.
[REF-1297]
Observed Examples
Reference Description
CVE-2022-31260 Chain: a digital asset management program has an undisclosed backdoor
in the legacy version of a PHP script (CWE-912) that could allow an
unauthenticated user to export metadata (CWE-306)
https://www.cve.org/CVERecord?id=CVE-2022-31260
CVE-2022-29951 TCP-based protocol in Programmable Logic Controller (PLC) has no
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-29951
CVE-2022-29952 Condition Monitor firmware uses a protocol that does not require
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-29952
CVE-2022-30276 SCADA-based protocol for bridging WAN and LAN traffic has no
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-30276
CVE-2022-30313 Safety Instrumented System uses proprietary TCP protocols with no
authentication.
https://www.cve.org/CVERecord?id=CVE-2022-30313
CVE-2022-30317 Distributed Control System (DCS) uses a protocol that has no authentication.
https://www.cve.org/CVERecord?id=CVE-2022-30317
CVE-2021-21972 Chain: Cloud computing virtualization platform does not require authentication
for upload of a tar format file (CWE-306), then uses .. path traversal sequences
(CWE-23) in the file to access unexpected files, as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21972
CWE Version 4.14
CWE-306: Missing Authentication for Critical Function
CWE-306: Missing Authentication for Critical Function