The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

Integrated circuits and hardware engines can expose accesses to assets (device configuration, keys, etc.) to trusted firmware or a software module (commonly set by BIOS/bootloader). This access is typically access-controlled. Upon a power reset, the hardware or system usually starts with default values in registers, and the trusted firmware (Boot firmware) configures the necessary access-control protection.
A common weakness that can exist in such protection schemes is that access controls or policies are not granular enough. This condition allows agents beyond trusted agents to access assets and could lead to a loss of functionality or the ability to set up the device securely. This further results in security risks from leaked, sensitive, key material to modification of device configuration.

Primary

Architecture and Design
Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.

Implementation
Such issues could be introduced during hardware implementation and identified later during Testing or System Configuration phases.

Confidentiality
Integrity
Availability
Access Control
Modify Memory
Read Memory
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Other
High

Architecture and Design
Implementation
Testing

Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.
Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.

High

Consider a system with a register for storing AES key for encryption or decryption. The key is 128 bits, implemented as a set of four 32-bit registers. The key registers are assets and registers, AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY, and are defined to provide necessary access controls.
The read-policy register defines which agents can read the AES-key registers, and write-policy register defines which agents can program or write to those registers. Each register is a 32-bit register, and it can support access control for a maximum of 32 agents. The number of the bit when set (i.e., "1") allows respective action from an agent whose identity matches the number of the bit and, if "0" (i.e., Clear), disallows the respective action to that corresponding agent.

Register
Field description

AES_ENC_DEC_KEY_0
AES key [0:31] for encryption or decryptionDefault 0x00000000

AES_ENC_DEC_KEY_1
AES key [32:63] for encryption or decryptionDefault 0x00000000

AES_ENC_DEC_KEY_2
AES key [64:95] for encryption or decryptionDefault 0x00000000

AES_ENC_DEC_KEY_4
AES key [96:127] for encryption or decryptionDefault 0x00000000

AES_KEY_READ_WRITE_POLICY
[31:0] Default 0x00000006 - meaning agent with identities "1" and "2" can both read from and write to key registers

In the above example, there is only one policy register that controls access to both read and write accesses to the AES-key registers, and thus the design is not granular enough to separate read and writes access for different agents. Here, agent with identities "1" and "2" can both read and write.
A good design should be granular enough to provide separate access controls to separate actions. Access control for reads should be separate from writes. Below is an example of such implementation where two policy registers are defined for each of these actions. The policy is defined such that: the AES-key registers can only be read or used by a crypto agent with identity "1" when bit #1 is set. The AES-key registers can only be programmed by a trusted firmware with identity "2" when bit #2 is set.

AES_KEY_READ_POLICY
[31:0] Default 0x00000002 - meaning only Crypto engine with identity "1" can read registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3

AES_KEY_WRITE_POLICY
[31:0] Default 0x00000004 - meaning only trusted firmware with identity "2" can program registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3

Within the AXI node interface wrapper module in the RISC-V AXI module of the HACK@DAC'19 CVA6 SoC [REF-1346], an access control mechanism is employed to regulate the access of different privileged users to peripherals.

The AXI ensures that only users with appropriate privileges can access specific peripherals. For instance, a ROM module is accessible exclusively with Machine privilege, and AXI enforces that users attempting to read data from the ROM must possess machine privilege; otherwise, access to the ROM is denied. The access control information and configurations are stored in a ROM.

...
for (i=0; i<NB_SUBORDINATE; i++)
begin
for (j=0; j<NB_MANAGER; j++)
begin
assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i] || ((j==6) && access_ctrl_i[i][7][priv_lvl_i]);
end
end
...

However, in the example code above, while assigning distinct privileges to AXI manager and subordinates, both the Platform-Level Interrupt Controller Specification (PLIC) and the Core-local Interrupt Controller (CLINT) (which are peripheral numbers 6 and 7 respectively) utilize the same access control configuration. This common configuration diminishes the granularity of the AXI access control mechanism.
In certain situations, it might be necessary to grant higher privileges for accessing the PLIC than those required for accessing the CLINT. Unfortunately, this differentiation is overlooked, allowing an attacker to access the PLIC with lower privileges than intended.
As a consequence, unprivileged code can read and write to the PLIC even when it was not intended to do so. In the worst-case scenario, the attacker could manipulate interrupt priorities, potentially modifying the system's behavior or availability.
To address the aforementioned vulnerability, developers must enhance the AXI access control granularity by implementing distinct access control entries for the Platform-Level Interrupt Controller (PLIC) and the Core-local Interrupt Controller (CLINT). By doing so, different privilege levels can be defined for accessing PLIC and CLINT, effectively thwarting the potential attacks previously highlighted. This approach ensures a more robust and secure system, safeguarding against unauthorized access and manipulation of interrupt priorities. [REF-1347]

...
for (i=0; i<NB_SUBORDINATE; i++)
begin
for (j=0; j<NB_MANAGER; j++)
begin
assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i];
end
end
...

Consider the following SoC
design. The sram in HRoT has an address range that is readable and writable by unprivileged
software and it has an area that is only readable by unprivileged software. The tbus
interconnect enforces access control for subordinates on the bus but uses only one bit to control
both read and write access. Address 0xA0000000 - 0xA000FFFF is readable and writable
by the untrusted cores core{0-N} and address 0xA0010000 - 0xA001FFFF is only
readable by the untrusted cores core{0-N}.

The security policy access control is not granular enough, as it uses one bit to enable both
read and write access. This gives write access to an area that should only be readable
by unprivileged agents.

Access control logic should differentiate between read and write access and to have
sufficient address granularity.

CVE-2022-24985
A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
https://www.cve.org/CVERecord?id=CVE-2022-24985

CVE-2021-36934
An operating system has an overly permission Access Control List onsome system files, including those related to user passwords
https://www.cve.org/CVERecord?id=CVE-2021-36934

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2020-02-05
4.0
2020-02-24

CWE Content Team
MITRE
2020-06-25
updated Demonstrative_Examples

CWE Content Team
MITRE
2020-08-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-07-20
updated Demonstrative_Examples

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples, References

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Cycuity (originally submitted as Tortuga Logic)
2021-07-16
Provided Demonstrative Example for Hardware Root of Trust

Shaza Zeitouni, Mohamadreza Rostami, Pouya Mahmoody, Ahmad-Reza Sadeghi
Technical University of Darmstadt
2023-06-21
suggested demonstrative example

Rahul Kande, Chen Chen, Jeyavijayan Rajendran
Texas A&M University
2023-06-21
suggested demonstrative example