Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1191: On-Chip Debug and Test Interface With Improper Access Control

Base

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

More detail

If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface.

How to prevent it (1 mitigation)

  1. Architecture and Design

    If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.

Source: MITRE CWE-1191

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2024-4231 Public exploit

    Incorrect Access Control Vulnerability in Digisol Router

    This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by iden…

    Digisol Digisol Router DG-GR1321
  • Medium 6.8
    CVE-2022-43096 Public exploit

    Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.