目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

CWE-1244 类漏洞列表 11

CWE-1244 类弱点 11 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1244 指内部资产被暴露于不安全的调试访问级别或状态。该漏洞源于产品错误地为内部资产分配了过高的调试权限，导致未受信任的调试代理能意外访问敏感数据。攻击者通常利用物理调试接口，通过提升权限读取或修改受保护资源。开发者应避免在生产环境中启用调试功能，严格实施最小权限原则，并确保调试接口仅在受控测试环境下使用，从而防止敏感资产泄露。

MITRE CWE 官方描述
CWE：CWE-1244 内部资产暴露于不安全的调试访问级别或状态 产品使用了支持多种访问级别的物理调试或测试接口，但为内部资产分配了错误的调试访问级别，导致未受信任的调试代理（debug agents）能够意外访问该资产。 调试授权（Debug authorization）可以具有多个访问级别，这些级别被定义为基于当前授权的调试级别来访问不同的系统内部资产。除了调试器认证（例如使用密码或挑战响应）之外，授权还可以基于系统状态或启动阶段。例如，完整的系统调试访问可能仅在系统重置后的早期启动阶段才被允许，以确保经过认证的调试器无法访问之前的会话数据。
常见影响 (3)
ConfidentialityRead Memory
If a protection mechanism does not ensure that internal assets have the correct debug access level during each boot stage or change in system state, an attacker could obtain sensitive information from the internal asset using a debugger.
IntegrityModify Memory
Authorization, Access ControlGain Privileges or Assume Identity, Bypass Protection Mechanism
缓解措施 (3)
Architecture and Design, ImplementationFor security-sensitive assets accessible over debug/test interfaces, only allow trusted agents.
Effectiveness: High
Architecture and DesignApply blinding [REF-1219] or masking techniques in strategic areas.
Effectiveness: Limited
ImplementationAdd shielding or tamper-resistant protections to the device, which increases the difficulty and cost for accessing debug/test interfaces.
Effectiveness: Limited
代码示例 (2)
The JTAG interface is used to perform debugging and provide CPU core access for developers. JTAG-access protection is implemented as part of the JTAG_SHIELD bit in the hw_digctl_ctrl register. This register has no default value at power up and is set only after the system boots from ROM and control is transferred to the user software.
1 bit 0x0 = JTAG debugger is enabled (default) JTAG_SHIELD 0x1 = JTAG debugger is disabled
Bad · Other
The default value of this register bit should be set to 1 to prevent the JTAG from being enabled at system reset.
Informative
The example code below is taken from the CVA6 processor core of the HACK@DAC'21 buggy OpenPiton SoC. Debug access allows users to access internal hardware registers that are otherwise not exposed for user access or restricted access through access control protocols. Hence, requests to enter debug mode are checked and authorized only if the processor has sufficient privileges. In addition, debug ac…
module csr_regfile #( ... // check that we actually want to enter debug depending on the privilege level we are currently in unique case (priv_lvl_o) riscv::PRIV_LVL_M: begin debug_mode_d = dcsr_q.ebreakm; ... riscv::PRIV_LVL_U: begin debug_mode_d = dcsr_q.ebreaku; ... assign priv_lvl_o = (debug_mode_q || umode_i) ?  riscv::PRIV_LVL_M : priv_lvl_q; ... debug_mode_q  <= debug_mode_d; ...
Bad · Verilog
module csr_regfile #( ... // check that we actually want to enter debug depending on the privilege level we are currently in unique case (priv_lvl_o) riscv::PRIV_LVL_M: begin debug_mode_d = dcsr_q.ebreakm; ... riscv::PRIV_LVL_U: begin debug_mode_d = dcsr_q.ebreaku; ... assign priv_lvl_o = (debug_mode_q && umode_i) ? riscv::PRIV_LVL_M : priv_lvl_q; ... debug_mode_q  <= debug_mode_d; ...
Good · Verilog
CVE ID标题CVSS风险等级Published
CVE-2025-67862 Fortinet FortiOS和Fortinet FortiProxy 安全漏洞 — FortiOS 6.0 Medium2026-06-09
CVE-2025-36755 CleverDisplay BlueOne 安全漏洞 — BlueOne (CleverDisplay Hardware Player) 2.4AILowAI2025-12-12
CVE-2025-42878 SAP Web Dispatcher和SAP Internet Communication Manager 安全漏洞 — SAP Web Dispatcher and Internet Communication Manager (ICM) 8.2 High2025-12-09
CVE-2025-23337 NVIDIA多款产品 安全漏洞 — HGX GB200, HGX GB300, HGC B300 6.7 Medium2025-09-17
CVE-2025-23302 NVIDIA DGX和NVIDIA HGX 安全漏洞 — HGX, DGX Hopper 4.2 Medium2025-09-04
CVE-2025-23301 NVIDIA DGX和NVIDIA HGX 安全漏洞 — HGX, DGX Hopper 4.2 Medium2025-09-04
CVE-2025-20238 Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software 6.0 Medium2025-08-14
CVE-2025-23252 NVIDIA NVDebug tool 安全漏洞 — NVDebug tool 4.5 Medium2025-06-18
CVE-2024-0114 NVIDIA Hopper HGX 8-GPU 安全漏洞 — NVIDIA Hopper HGX 8-GPU 8.1 High2025-03-05
CVE-2022-32259 Siemens SINEMA Remote Connect Server 安全漏洞 — SINEMA Remote Connect Server 6.5 Medium2022-06-14
CVE-2020-5372 Dell EMC PowerStore 安全漏洞 — PowerStore 8.6 High2020-07-06

CWE-1244 是常见的弱点类别，本平台收录该类弱点关联的 11 条 CVE 漏洞。