The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Primary

Resultant

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Other
Varies by Context
Unexpected State

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple vendors did not sign firmware images.

CVE-2022-30260
Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
https://www.cve.org/CVERecord?id=CVE-2022-30260

CVE-2022-30267
Distributed Control System (DCS) does not sign firmware images and only relies on insecure checksums for integrity checks
https://www.cve.org/CVERecord?id=CVE-2022-30267

CVE-2022-30272
Remote Terminal Unit (RTU) does not use signatures for firmware images and relies on insecure checksums
https://www.cve.org/CVERecord?id=CVE-2022-30272

Insufficient Verification of Data

A3
Broken Authentication and Session Management
CWE More Specific

12
Content Spoofing

Discouraged
This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

"origin validation" could fall under this.
The specific ways in which the origin is not properly identified should be laid out as separate weaknesses. In some sense, this is more like a category.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Maintenance_Notes, Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Related_Attack_Patterns

CWE Content Team
MITRE
2009-07-27
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-02-16
updated Taxonomy_Mappings

CWE Content Team
MITRE
2010-04-05
updated Related_Attack_Patterns

CWE Content Team
MITRE
2010-12-13
updated Related_Attack_Patterns

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, References, Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Insufficient Verification of Data