Description
The product does not provide its
users with the ability to update or patch its
firmware to address any vulnerabilities or
weaknesses that may be present.
Potential Impact
- Confidentiality: Gain Privileges or Assume Identity
How to Fix
Requirements
Specify requirements to include the ability to update the firmware. Include integrity checks and authentication to ensure that untrusted firmware cannot be installed.
Architecture and Design
Design the device to allow for updating the firmware. Ensure that the design specifies how to distribute the updates and ensure their integrity and authentication.
Implementation
Implement the necessary functionality to allow the firmware to be updated.
Detection Methods
- Manual Analysis: Create a new installable boot image of the current build with a minor version number change. Use the standard installation method to update the boot image. Verify that the minor version number has cha...
- Architecture or Design Review: Check the consumer or maintainer documentation, the architecture/design documentation, or the original requirements to ensure that the documentation includes details for how to update the firmware....
- Manual Dynamic Analysis: Determine if there is a lack of a capability to update read-only memory (ROM) structure. This could manifest as a difference between the latest firmware version and the current version within the devi...
Related Weaknesses
References
View on MITRE CWE Database →
