Common Weakness Enumeration (CWE)

The hardware logic does not effectively handle when single-event upsets (SEUs) occur.

The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.

The product uses an obsolete encoding mechanism to implement access controls.

Security-critical logic is not set to a known value on reset.

The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.

Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.

The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.

The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.

The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.

The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.

The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.

The product's debug components contain incorrect chaining or granularity of debug components.

The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.

The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.

The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.

The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.

The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.

On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.

This entry has been deprecated because it was at a lower level of abstraction than supported by CWE. All relevant content has been integrated into CWE-319.

Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.

The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.

A hardware device is missing or has inadequate protection features to prevent overheating.

The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result.

A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.

The product has a dependency on a third-party component that contains one or more known vulnerabilities.