Weakness (CWE)
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State
The product uses physical debug or test
interfaces with support for multiple access levels, but it
assigns the wrong debug access level to an internal asset,
providing unintended access to the asset from untrusted debug
agents.
How to prevent it (3 mitigations)
-
Architecture and Design, Implementation
For security-sensitive assets accessible over debug/test interfaces, only allow trusted agents.
-
Architecture and Design
Apply blinding [REF-1219] or masking techniques in strategic areas.
-
Implementation
Add shielding or tamper-resistant protections to the device, which increases the difficulty and cost for accessing debug/test interfaces.
Source: MITRE CWE-1244
5 results · Clear filters · Feed
-
High 8.6
Open Recovery Mode
Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware …
-
High 7.8
A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted…
-
High 8.2
Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high i…
-
High 8.1
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious …
-
High 8.6
Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that exposes test interface ports to extern…