The product does not provide its
users with the ability to update or patch its
firmware to address any vulnerabilities or
weaknesses that may be present.
Without the ability to
patch or update firmware, consumers will be
left vulnerable to exploitation of any known
vulnerabilities, or any vulnerabilities that
are discovered in the future. This can expose
consumers to permanent risk throughout the
entire lifetime of the device, which could be
years or decades. Some external protective
measures and mitigations might be employed to
aid in preventing or reducing the risk of
malicious attack, but the root weakness cannot
be corrected.

Primary

Requirements
Requirements development might not consider the importance of updates over the lifetime of the product, or might not choose the ability due to concerns such as expense or speed to market.

Architecture and Design
Lack of planning during architecture development and design, or external pressures such as speed to market, could ignore the capability to update.

Implementation
The weakness can appear through oversight during implementation.

Confidentiality
Integrity
Access Control
Authentication
Authorization
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Execute Unauthorized Code or Commands
DoS: Crash, Exit, or Restart
Medium
If an attacker can identify an exploitable vulnerability in one device that has no means of patching, the attack may be used against an entire class of devices.

Manual Analysis
Create a new installable boot image of the current build with a minor version number change. Use the standard installation method to update the boot image. Verify that the minor version number has changed. Create a fake image. Verify that the boot updater will not install the fake image and generates an "invalid image" error message or equivalent.
High

Architecture or Design Review
Check the consumer or maintainer documentation, the architecture/design documentation, or the original requirements to ensure that the documentation includes details for how to update the firmware.
Moderate

Manual Dynamic Analysis
Determine if there is a lack of a capability to update read-only memory (ROM) structure. This could manifest as a difference between the latest firmware version and the current version within the device.
High

Requirements
Specify requirements to include the ability to update the firmware. Include integrity checks and authentication to ensure that untrusted firmware cannot be installed.

Architecture and Design
Design the device to allow for updating the firmware. Ensure that the design specifies how to distribute the updates and ensure their integrity and authentication.

Implementation
Implement the necessary functionality to allow the firmware to be updated.

A refrigerator has an Internet interface for the official purpose of alerting the manufacturer when that refrigerator detects a fault. Because the device is attached to the Internet, the refrigerator is a target for hackers who may wish to use the device other potentially more nefarious purposes.
The refrigerator has no means of patching and is hacked, becoming a spewer of email spam.
The device automatically patches itself and provides considerable more protection against being hacked.

CVE-2020-9054
Chain: network-attached storage (NAS) device has a critical OS command injection (CWE-78) vulnerability that is actively exploited to place IoT devices into a botnet, but some products are "end-of-support" and cannot be patched (CWE-1277). [REF-1097]
https://www.cve.org/CVERecord?id=CVE-2020-9054

[REF-1095]
A hardware "smart lock" has weak key generation that allows attackers to steal the key by BLE sniffing, but the device's firmware cannot be upgraded and hence remains vulnerable [REF-1095].
https://www.theregister.com/2019/12/11/f_secure_keywe/

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

The "firmware" term does not have a single commonly-shared definition, so there may be variations in how this CWE entry is interpreted during mapping.

Paul A. Wortman
Wells Fargo
2020-05-13
4.1
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations

CWE Content Team
MITRE
2020-12-10
updated Description, Relationships

CWE Content Team
MITRE
2021-03-15
updated Maintenance_Notes

CWE Content Team
MITRE
2021-07-20
updated Demonstrative_Examples, Maintenance_Notes

CWE Content Team
MITRE
2021-10-28
updated Common_Consequences, Description, Detection_Factors, Maintenance_Notes, Modes_of_Introduction, Observed_Examples, References, Relationships, Terminology_Notes, Weakness_Ordinalities

CWE Content Team
MITRE
2022-04-28
updated Detection_Factors, Observed_Examples, Potential_Mitigations, Relationships

CWE Content Team
MITRE
2022-10-13
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Paul A. Wortman
Wells Fargo
2021-10-12
provided detection methods and observed examples