The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Primary

Resultant

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Implementation

Operation

Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism

Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Register SECURE_ME is located at address 0xF00. A
mirror of this register called COPY_OF_SECURE_ME is
at location 0x800F00. The register SECURE_ME is
protected from malicious agents and only allows
access to select, while COPY_OF_SECURE_ME is not.

Access control is implemented using an allowlist (as
indicated by acl_oh_allowlist). The identity of the
initiator of the transaction is indicated by the
one hot input, incoming_id. This is checked against
the acl_oh_allowlist (which contains a list of
initiators that are allowed to access the asset).

Though this example is shown in Verilog, it will
apply to VHDL as well.

module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n);
output [31:0] data_out;
input [31:0] data_in, incoming_id, address;
input clk, rst_n;
wire write_auth, addr_auth;
reg [31:0] data_out, acl_oh_allowlist, q;
assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0;
always @*

acl_oh_allowlist <= 32'h8312;

assign addr_auth = (address == 32'hF00) ? 1: 0;
always @ (posedge clk or negedge rst_n)

if (!rst_n)

begin

q <= 32'h0;
data_out <= 32'h0;

end

else

begin

q <= (addr_auth & write_auth) ? data_in: q;
data_out <= q;

end

end

endmodule

assign addr_auth = (address == 32'hF00) ? 1: 0;
The bugged line of code is repeated in the Bad
example above. The weakness arises from the fact that the
SECURE_ME register can be modified by writing to the
shadow register COPY_OF_SECURE_ME. The address of
COPY_OF_SECURE_ME should also be included in the check.
That buggy line of code should instead be replaced as
shown in the Good Code Snippet below.

assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;

CVE-2020-8004
When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
https://www.cve.org/CVERecord?id=CVE-2020-8004

CVE-2002-0567
DB server assumes that local clients have performed authentication, allowing attacker to directly connect to a process to load libraries and execute commands; a socket interface also exists (another alternate channel), so attack can be remote.
https://www.cve.org/CVERecord?id=CVE-2002-0567

CVE-2002-1578
Product does not restrict access to underlying database, so attacker can bypass restrictions by directly querying the database.
https://www.cve.org/CVERecord?id=CVE-2002-1578

CVE-2003-1035
User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.
https://www.cve.org/CVERecord?id=CVE-2003-1035

CVE-2002-1863
FTP service can not be disabled even when other access controls would require it.
https://www.cve.org/CVERecord?id=CVE-2002-1863

CVE-2002-0066
Windows named pipe created without authentication/access control, allowing configuration modification.
https://www.cve.org/CVERecord?id=CVE-2002-0066

CVE-2004-1461
Router management interface spawns a separate TCP connection after authentication, allowing hijacking by attacker coming from the same IP address.
https://www.cve.org/CVERecord?id=CVE-2004-1461

Unprotected Alternate Channel

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This can be primary to authentication errors, and resultant from unhandled error conditions.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Potential_Mitigations, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities