Weakness (CWE)
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
The lack of protections on alternate paths to access
control-protected assets (such as unprotected shadow registers
and other external facing unguarded interfaces) allows an
attacker to bypass existing protections to the asset that are
only performed against the primary path.
More detail
An asset inside a chip might have access-control
protections through one interface. However, if all paths to
the asset are not protected, an attacker might compromise
the asset through alternate paths. These alternate paths
could be through shadow or mirror registers inside the IP
core, or could be paths from other external-facing
interfaces to the IP core or SoC.
Consider an SoC with various interfaces such as UART,
SMBUS, PCIe, USB, etc. If access control is implemented for
SoC internal registers only over the PCIe interface, then
an attacker could still modify the SoC internal registers
through alternate paths by coming through interfaces such
as UART, SMBUS, USB, etc.
Alternatively, attackers might be able to bypass
existing protections by exploiting unprotected, shadow
registers. Shadow registers and mirror registers typically
refer to registers that can be accessed from multiple
addresses. Writing to or reading from the aliased/mirrored
address has the same effect as writing to the address of
the main register. They are typically implemented within an
IP core or SoC to temporarily hold certain data. These data
will later be updated to the main register, and both
registers will be in synch. If the shadow registers are not
access-protected, attackers could simply initiate
transactions to the shadow registers and compromise system
security.
How to prevent it (3 mitigations)
-
Requirements
Protect assets from accesses against all potential interfaces and alternate paths.
-
Architecture and Design
Protect assets from accesses against all potential interfaces and alternate paths.
-
Implementation
Protect assets from accesses against all potential interfaces and alternate paths.
Source: MITRE CWE-1299
11 results · Feed
-
Medium 6.8
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the pri…
-
High 7.9
Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R)…
-
Medium 6.8
Shell access to UART Console
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
-
High 7.5
Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unau…
-
Medium 6.8
Access to Bootloader and Shell Over Serial Interface
A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on…
-
Medium 6.8
Missing Protection Mechanism for Alternate Hardware Interface
The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.
-
Medium 4.6
IBM FlashSystem denial of service
IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data. IBM X-Force ID: 295935.
-
Low 2.4
Lack of DMA Access Protections
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryptio…
-
Medium 5.4
Lack of USB Whitelisting
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.
-
Medium 5.3
BD BodyGuard™ Pumps – RS-232 Interface Vulnerability
The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, specialized equipment and knowledge may be able to configure or disable the pump. No electronic protected…
-
Medium 6.8
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker w…