Book a Security Review

Weakness · High

CWE-1242: Inclusion of Undocumented Features or Chicken Bits

What it is

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

MITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
Not rated by MITRE
Introduced during
Architecture and Design, Documentation, Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

What an attacker can do

  • Modify Memory (Confidentiality, Integrity, Availability, Access Control)
  • Read Memory (Confidentiality, Integrity, Availability, Access Control)
  • Execute Unauthorized Code or Commands (Confidentiality, Integrity, Availability, Access Control)
  • Gain Privileges or Assume Identity (Confidentiality, Integrity, Availability, Access Control)
  • Bypass Protection Mechanism (Confidentiality, Integrity, Availability, Access Control)

How to prevent it

Architecture and Design

  • The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.

CWE-1242 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.