ICS Communications: Frail Security in Protocols

Opis

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Wpisy w tej grupie

• CWE-121 Stack-based Buffer Overflow
• CWE-125 Out-of-bounds Read
• CWE-268 Privilege Chaining
• CWE-269 Improper Privilege Management
• CWE-276 Incorrect Default Permissions
• CWE-290 Authentication Bypass by Spoofing
• CWE-306 Missing Authentication for Critical Function
• CWE-311 Missing Encryption of Sensitive Data
• CWE-312 Cleartext Storage of Sensitive Information
• CWE-319 Cleartext Transmission of Sensitive Information
• CWE-325 Missing Cryptographic Step
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-330 Use of Insufficiently Random Values
• CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG)
• CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
• CWE-341 Predictable from Observable State
• CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
• CWE-358 Improperly Implemented Security Check for Standard
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CWE-377 Insecure Temporary File
• CWE-384 Session Fixation
• CWE-648 Incorrect Use of Privileged APIs
• CWE-787 Out-of-bounds Write
• CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
• CWE-1303 Non-Transparent Sharing of Microarchitectural Resources
• CWE-1393 Use of Default Password

Uwagi

Relationships in this category are not authoritative and subject to change. See Maintenance notes.

Źródła