1830
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Varies by Context
Unexpected State
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors did not sign firmware images.
Observed Examples
Reference Description
CVE-2022-30260 Distributed Control System (DCS) does not sign firmware images and only
relies on insecure checksums for integrity checks
https://www.cve.org/CVERecord?id=CVE-2022-30260
CVE-2022-30267 Distributed Control System (DCS) does not sign firmware images and only
relies on insecure checksums for integrity checks
https://www.cve.org/CVERecord?id=CVE-2022-30267
CVE-2022-30272 Remote Terminal Unit (RTU) does not use signatures for firmware images and
relies on insecure checksums
https://www.cve.org/CVERecord?id=CVE-2022-30272
MemberOf Relationships
CWE Version 4.14
CWE-346: Origin Validation Error
CWE-346: Origin Validation Error