Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1277: Firmware Not Updateable

Base Draft

The product does not provide its
users with the ability to update or patch its
firmware to address any vulnerabilities or
weaknesses that may be present.

How to prevent it (3 mitigations)

  1. Requirements

    Specify requirements to include the ability to update the firmware. Include integrity checks and authentication to ensure that untrusted firmware cannot be installed.

  2. Architecture and Design

    Design the device to allow for updating the firmware. Ensure that the design specifies how to distribute the updates and ensure their integrity and authentication.

  3. Implementation

    Implement the necessary functionality to allow the firmware to be updated.

Source: MITRE CWE-1277

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.2
    CVE-2026-6484

    Lack of verified boot to certain FV may cause arbitrary code execution

    In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

    Insyde Software InsydeH2O