1699
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1288]Julia Lokrantz. "Ethical hacking of a Smart Automatic Feed Dispenser". 2021 June 7. <
http://kth.diva-portal.org/smash/get/diva2:1561552/FULLTEXT01.pdf >.
[REF-1304]ICS-CERT. "ICS Alert (ICS-ALERT-13-164-01): Medical Devices Hard-Coded
Passwords". 2013 June 3. < https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01
>.2023-04-07.
CWE-799: Improper Control of Interaction Frequency
Weakness ID : 799
Structure : Simple
Abstraction : Class
Description
The product does not properly limit the number or frequency of interactions that it has with an actor,
such as the number of incoming requests.
Extended Description
This can allow the actor to perform actions more frequently than expected. The actor could
be a human or an automated process such as a virus or bot. This could be used to cause a
denial of service, compromise program logic (such as limiting humans to a single vote), or other
consequences. For example, an authentication routine might not limit the number of times an
attacker can guess a password. Or, a web site might conduct a poll but only expect humans to vote
a maximum of once a day.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 691 Insufficient Control Flow Management 1517
ParentOf 307 Improper Restriction of Excessive Authentication Attempts 747
ParentOf 837 Improper Enforcement of a Single, Unique Action 1762
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Insufficient anti-automation : The term "insufficient anti-automation" focuses primarly on nonhuman
actors such as viruses or bots, but the scope of this CWE entry is broader.
Brute force : Vulnerabilities that can be targeted using brute force attacks are often symptomatic of
this weakness.
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
CWE Version 4.14
CWE-799: Improper Control of Interaction Frequency
CWE-799: Improper Control of Interaction Frequency