The product does not contain sufficient
technical or engineering documentation (whether on paper or
in electronic form) that contains descriptions of all the
relevant software/hardware elements of the product, such as
its usage, structure, architectural components, interfaces, design, implementation,
configuration, operation, etc.

When technical documentation is limited or lacking, products are more difficult to maintain. This indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities.
When using time-limited or labor-limited third-party/in-house security consulting services (such as threat modeling, vulnerability discovery, or pentesting), insufficient documentation can force those consultants to invest unnecessary time in learning how the product is organized, instead of focusing their expertise on finding the flaws or suggesting effective mitigations.
With respect to hardware design, the lack of a formal, final manufacturer reference can make it difficult or impossible to evaluate the final product, including post-manufacture verification. One cannot ensure that design functionality or operation is within acceptable tolerances, conforms to specifications, and is free from unexpected behavior. Hardware-related documentation may include engineering artifacts such as hardware description language (HDLs), netlists, Gerber files, Bills of Materials, EDA (Electronic Design Automation) tool files, etc.

Indirect

Architecture and Design

Documentation

Other
Varies by Context
Hide Activities
Reduce Reliability
Quality Degradation
Reduce Maintainability
Without a method of verification, one cannot be sure that everything only functions as expected.

Documentation
Architecture and Design
Ensure that design documentation is detailed enough to allow for post-manufacturing verification.

CVE-2022-3203
A wireless access point manual specifies that the only method of configuration is via web interface (CWE-1059), but there is an undisclosed telnet server that was activated by default (CWE-912).
https://www.cve.org/CVERecord?id=CVE-2022-3203

Part 2-4
Req SP.02.03 BR

Part 2-4
Req SP.02.03 RE(1)

Part 2-4
Req SP.03.03 RE(1)

Part 4-1
Req SG-1

Part 4-1
Req SG-2

Part 4-1
Req SG-3

Part 4-1
Req SG-4

Part 4-1
Req SG-5

Part 4-1
Req SG-6

Part 4-1
Req SG-7

Prohibited
This entry is primarily a quality issue with no direct security implications.
Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

CWE Content Team
MITRE
2018-07-02
3.2
2019-01-03
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-04-28
updated Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, References, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

Paul A. Wortman
Wells Fargo
2021-06-11
Submitted hardware-specific information about a "golden standard" that was integrated into this entry

"Mapping CWE to 62443" Sub-Working Group
CWE-CAPEC ICS/OT SIG
2023-04-25
Suggested mappings to ISA/IEC 62443.

Incomplete Documentation