CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
baseThe chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (33)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-43096US | medium6.8 | Exploit | ||
Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. | ||||
| CVE-2026-8989US | medium6.8 | — | ||
Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical acc… | ||||
| CVE-2026-8988US | medium6.8 | — | ||
Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attac… | ||||
| CVE-2025-47822US | medium6.8 | — | ||
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. | ||||
| CVE-2025-47819US | medium6.8 | — | ||
Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. | ||||
| CVE-2020-9285US | medium6.8 | — | ||
Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI Express slot on the mo… | ||||
| CVE-2025-12114US | medium5.5 | — | ||
Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | ||||
| CVE-2022-25368US | medium4.7 | — | ||
Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware co… | ||||
| CVE-2025-15083US | medium4.6 | — | ||
A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulation can lead to on-chip… | ||||
| CVE-2024-4231US | — | Exploit | ||
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without pr… | ||||
| CVE-2026-34494US | — | — | ||
- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.
This issue affects Neo Series MVP2: before 3.3b63. | ||||
| CVE-2026-34493US | — | — | ||
- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.
This issue affects EasyIO FS32: before 3.3b63. | ||||
| CVE-2026-102370US | — | — | ||
Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface at the
firmware or chip level and do not lock the bootloader. Although the debug traces are physic… | ||||
| CVE-2026-80359US | — | — | ||
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G… | ||||
| CVE-2026-80358US | — | — | ||
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G… | ||||
| CVE-2026-80357US | — | — | ||
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G… | ||||
| CVE-2026-15203US | — | — | ||
Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal valu… | ||||
| CVE-2025-52533US | — | — | ||
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity. | ||||
| CVE-2024-36319US | — | — | ||
Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to perform read/writes HW r… | ||||
| CVE-2025-36755US | — | — | ||
The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that,… | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan