CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
常见后果
影响范围: Confidentiality
技术影响: Read Memory Read Application Data
潜在缓解措施
阶段: Architecture and Design
描述: Apply blinding or masking techniques to implementations of cryptographic algorithms.
阶段: Implementation
描述: Alter the method of erasure, add protection of media, or destroy the media to protect the data.
观察示例
参考: CVE-2019-8575
Firmware Data Deletion Vulnerability in which a base station factory reset might not delete all user information. The impact of this enables a new owner of a used device that has been "factory-default reset" with a vulnerable firmware version can still retrieve, at least, the previous owner's wireless network name, and the previous owner's wireless security (such as WPA2) key. This issue was addressed with improved, data deletion.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |