auren-research/cyber-sec huggingface dataset:
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.

Hardware sensors are used to detect whether a device is operating within design limits. The threshold values for these limits are set by hardware fuses or trusted software such as a BIOS.
Modification of these limits may be protected by hardware mechanisms.
When device sensors detect out of bound conditions, alert signals may be generated for remedial action, which may take the form of device shutdown or throttling.
Warning signals that are not properly secured may be disabled or used to generate spurious alerts, causing degraded performance or denial-of-service (DoS).
These alerts may be masked by untrusted software. Examples of these alerts involve thermal and power sensor alerts.

Primary

Architecture and Design

Implementation

Availability
DoS: Instability
DoS: Crash, Exit, or Restart
Reduce Reliability
Unexpected State
High

Architecture and Design
Alert signals generated by critical events should be protected from access by untrusted agents. Only hardware or trusted firmware modules should be able to alter the alert configuration.

Consider a platform design where a Digital-Thermal Sensor (DTS) is used to monitor temperature and compare that output against a threshold value.
If the temperature output equals or exceeds the threshold value, the DTS unit sends an alert signal to the processor.
The processor, upon getting the alert, input triggers system shutdown. The alert signal is handled as a General-Purpose-I/O (GPIO) pin in input mode.

The processor-GPIO controller exposes software-programmable controls that allow untrusted software to reprogram the state of the GPIO pin.
Reprogramming the state of the GPIO pin allows malicious software to trigger spurious alerts or to set the alert pin to a zero value so that thermal sensor alerts are not received by the processor.
The GPIO alert-signal pin is blocked from untrusted software access and is controlled only by trusted software, such as the System BIOS.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Hareesh Khattri, Arun Kanuparthi, Parbati K. Manna
Intel Corporation
2020-05-29
4.3
2020-12-10

CWE Content Team
MITRE
2022-04-28
updated Applicable_Platforms

CWE Content Team
MITRE
2022-06-28
updated Applicable_Platforms

CWE Content Team
MITRE
2022-10-13
updated Name

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Improper Protection for Out of Bounds Signal Level Alerts
The product uses a non-blocking model that relies on a single threaded process
for features such as scalability, but it contains code that can block when it is invoked.

When an attacker can directly invoke the blocking code, or the blocking code can be affected by environmental conditions that can be influenced by an attacker, then this can lead to a denial of service by causing unexpected hang or freeze of the code. Examples of blocking code might be an expensive computation or calling
blocking library calls, such as those that perform exclusive file operations or require a successful network operation.
Due to limitations in multi-thread models, single-threaded
models are used to overcome the resource constraints that are caused by using
many threads. In such a model, all code should generally be
non-blocking. If blocking code is called, then the event loop will
effectively be stopped, which can be undesirable or dangerous. Such
models are used in Python asyncio, Vert.x, and Node.js, or other
custom event loop code.

Primary

Implementation

Availability
DoS: Resource Consumption (CPU)
An unexpected call to blocking code can trigger an infinite loop, or a large loop that causes the software to pause and wait indefinitely.

Implementation
Generally speaking, blocking calls should be
replaced with non-blocking alternatives that can be used asynchronously.
Expensive computations should be passed off to worker threads, although
the correct approach depends on the framework being used.

Implementation
For expensive computations, consider breaking them up into
multiple smaller computations. Refer to the documentation of the
framework being used for guidance.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Joe Harvey
2019-10-25
4.3
2020-12-10

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities
This entry has been deprecated because it was at a lower level of abstraction than supported by CWE. All relevant content has been integrated into CWE-319.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

Accellera IP Security Assurance (IPSA) Working Group
Accellera Systems Initiative
2020-10-01
4.3
2020-12-10

CWE Content Team
MITRE
2021-10-28
updated Potential_Mitigations

CWE Content Team
MITRE
2022-04-28
updated Applicable_Platforms

CWE Content Team
MITRE
2022-06-28
updated Applicable_Platforms

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Name, Potential_Mitigations, Related_Attack_Patterns, Relationships, Time_of_Introduction, Type

CWE Content Team
MITRE
2023-04-27
updated Mapping_Notes

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Sensitive Information Accessible by Physical Probing of JTAG Interface
The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

When a server binds to the address 0.0.0.0, it allows connections from every IP address on the local machine, effectively exposing the server to every possible network. This might be much broader access than intended by the developer or administrator, who might only be expecting the server to be reachable from a single interface/network.

Primary

System Configuration

Availability
DoS: Amplification
High

System Configuration
Assign IP addresses that are not 0.0.0.0.
High

System Configuration
Firewall
Unwanted connections to the configured server may be denied through a firewall or other packet filtering measures.
High

The following code snippet uses 0.0.0.0 in a Puppet script.

signingserver::instance {

"nightly-key-signing-server":

listenaddr => "0.0.0.0",
port => "9100",
code_tag => "SIGNING_SERVER",

}

The Puppet code snippet is used to provision a signing server that will use 0.0.0.0 to accept traffic. However, as 0.0.0.0 is unrestricted, malicious users may use this IP address to launch frequent requests and cause denial of service attacks.

signingserver::instance {

"nightly-key-signing-server":

listenaddr => "127.0.0.1",
port => "9100",
code_tag => "SIGNING_SERVER",

}

CVE-2022-21947
Desktop manager for Kubernetes and container management binds a service to 0.0.0.0, allowing users on the network to make requests to a dashboard API.
https://www.cve.org/CVERecord?id=CVE-2022-21947

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Akond Rahman
Tennessee Technological University
2020-09-08
4.3
2020-12-10

CWE Content Team
MITRE
2021-03-15
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.

To ensure the performance and functional reliability of certain components, hardware designers can implement hardware blocks for redundancy in the case that others fail. This redundant block can be prevented from performing as intended if the design allows unauthorized agents to inject errors into it. In this way, a path with injected errors may become unavailable to serve as a redundant channel. This may put the system into a degraded mode of operation which could be exploited by a subsequent attack.

Primary

Architecture and Design
Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.

Implementation
Such issues could be introduced during implementation and identified later during Testing or System Configuration phases.

Integration
Such issues could be introduced during integration and identified later during Testing or System Configuration phases.

Integrity
Availability
DoS: Crash, Exit, or Restart
DoS: Instability
Quality Degradation
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
Reduce Performance
Reduce Reliability
Unexpected State

Architecture and Design
Ensure the design does not allow error injection in modes intended for normal run-time operation. Provide access controls on interfaces for injecting errors.

Implementation
Disallow error injection in modes which are expected to be used for normal run-time operation. Provide access controls on interfaces for injecting errors.

Integration
Add an access control layer atop any unprotected interfaces for injecting errors.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

James Pangburn
Accellera IP Security Assurance (IPSA) Working Group
2020-07-29
4.3
2020-12-10

CWE Content Team
MITRE
2023-01-31
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
A hardware device, or the firmware running on it, is
missing or has incorrect protection features to maintain
goals of security primitives when the device is cooled below
standard operating temperatures.

The hardware designer may improperly anticipate
hardware behavior when exposed to exceptionally cold
conditions. As a result they may introduce a weakness by not
accounting for the modified behavior of critical components
when in extreme environments.
An example of a change in behavior is that power loss
won't clear/reset any volatile state when cooled below
standard operating temperatures. This may result in
a weakness when the starting state of the volatile memory is
being relied upon for a security decision. For example, a
Physical Unclonable Function (PUF) may be supplied as a
security primitive to improve confidentiality,
authenticity, and integrity guarantees. However, when the
PUF is paired with DRAM, SRAM, or another temperature
sensitive entropy source, the system designer may introduce
weakness by failing to account for the chosen entropy
source's behavior at exceptionally low temperatures. In the
case of DRAM and SRAM, when power is cycled at low
temperatures, the device will not contain the bitwise
biasing caused by inconsistencies in manufacturing and will
instead contain the data from previous boot. Should the PUF
primitive be used in a cryptographic construction which
does not account for full adversary control of PUF seed
data, weakness would arise.
This weakness does not cover "Cold Boot Attacks"
wherein RAM or other external storage is super cooled and
read externally by an attacker.

Primary

Architecture and Design

Implementation

Integrity
Authentication
Varies by Context
Unexpected State
Low
Consequences of this weakness are highly contextual.

Architecture and Design
The system should account for security primitive behavior when cooled outside standard temperatures.

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Paul A. Wortman
Wells Fargo
2020-10-23
4.5
2021-07-20

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2022-06-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated References, Related_Attack_Patterns

CWE Content Team
MITRE
2023-01-31
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The product uses a default cryptographic key for potentially critical functionality.

It is common practice for products to be designed to use
default keys. The rationale is to simplify the manufacturing
process or the system administrator's task of installation and
deployment into an enterprise. However, if admins do not
change the defaults, it is easier for attackers to bypass
authentication quickly across multiple organizations.

Primary

Architecture and Design

Authentication
Gain Privileges or Assume Identity

Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
High

Architecture and Design
Force the administrator to change the credential upon installation.
High

Installation
Operation
The product administrator could change the defaults upon installation or during operation.
Moderate

CVE-2018-3825
cloud cluster management product has a default master encryption key
https://www.cve.org/CVERecord?id=CVE-2018-3825

CVE-2016-1561
backup storage product has a default SSH public key in the authorized_keys file, allowing root access
https://www.cve.org/CVERecord?id=CVE-2016-1561

CVE-2010-2306
Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic
https://www.cve.org/CVERecord?id=CVE-2010-2306

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2022-10-07
4.9
2022-10-13

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
A regular expression is overly restrictive, which prevents dangerous values from being detected.
This weakness is not about regular expression complexity. Rather, it is about a regular expression that does not match all values that are intended. Consider the use of a regexp to identify acceptable values or to spot unwanted terms. An overly restrictive regexp misses some potentially security-relevant values leading to either false positives *or* false negatives, depending on how the regexp is being used within the code. Consider the expression /[0-8]/ where the intention was /[0-9]/. This expression is not "complex" but the value "9" is not matched when maybe the programmer planned to check for it.

Primary

Implementation

Access Control
Bypass Protection Mechanism

Implementation
Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject your regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor your regular expression.

CVE-2005-1604
MIE. ".php.ns" bypasses ".php$" regexp but is still parsed as PHP by Apache. (manipulates an equivalence property under Apache)
https://www.cve.org/CVERecord?id=CVE-2005-1604

Overly Restrictive Regular Expression

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Can overlap allowlist/denylist errors (CWE-183/CWE-184)

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-01-03
updated Description

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-06-25
updated Relationship_Notes

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities
The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

Primary

Implementation

Integrity
Unexpected State

Black Box
Because byte ordering bugs are usually very noticeable even with normal inputs, this bug is more likely to occur in rarely triggered error conditions, making them difficult to detect using black box methods.

Memory Management

Memory

Numeric Byte Ordering Error

FIO12-J
Provide methods to read and write little-endian data

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Under-reported.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Detection_Factors, Relationships, Research_Gaps, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Description

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction, Type

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated Affected_Resources, Functional_Areas

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Numeric Byte Ordering Error
The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.

Ideally, a product should provide as little information about its internal operations as possible. Otherwise, attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.

Primary

Resultant

Architecture and Design

Implementation

Confidentiality
Access Control
Read Application Data
Bypass Protection Mechanism

CVE-2002-0208
Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.
https://www.cve.org/CVERecord?id=CVE-2002-0208

CVE-2004-2252
Behavioral infoleak by responding to SYN-FIN packets.
https://www.cve.org/CVERecord?id=CVE-2004-2252

Behavioral Discrepancy Infoleak

45
Fingerprinting

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2009-12-28
updated Description, Name

CWE Content Team
MITRE
2010-02-16
updated Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Description, Name, Observed_Examples, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Behavioral Discrepancy Information Leak
Information Exposure Through Behavioral Discrepancy