目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-1329 类漏洞列表 3

CWE-1329 类弱点 3 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1329 指软件依赖无法更新或打补丁的组件。当该组件暴露漏洞时，开发者无法通过常规手段修复，导致系统长期处于风险中。攻击者可利用此缺陷实施持久化攻击或拒绝服务。为避免此类问题，开发者应在架构设计阶段严格评估第三方组件的可维护性，优先选择支持持续安全更新的库，并建立组件生命周期监控机制，确保在发现漏洞时能及时替换或隔离风险源。

MITRE CWE 官方描述
CWE：CWE-1329 依赖不可更新的组件 (Reliance on Component That is Not Updateable) 英文：该产品包含一个无法通过更新或修补来移除漏洞或重大缺陷的组件。 如果该组件被发现存在漏洞或关键缺陷，但无法通过更新或修补来修复该问题，那么产品所有者将无法针对该问题进行防护。唯一的选项可能是更换产品，但这对于产品所有者来说可能在财务或运营上过于昂贵。因此，无法修补或更新可能导致产品易受攻击者利用或出现关键性操作故障。在使用 ROM、固件或类似传统上具有有限或无更新能力的组件时，这种弱点尤其难以管理。在医疗保健等行业中，“遗留”设备可以运行数十年。正如美国一个特别工作组报告 [REF-1197] 所指出的，“无法更新或替换设备使得大型和小型医疗保健交付组织都难以应对大量无法轻易替换（硬件、软件和操作系统）且存在大量漏洞且缺乏现代对策的遗留系统。”虽然硬件容易出现这种弱点，但软件系统也会受到影响，例如当第三方驱动程序或库不再积极维护或支持，但对于所需功能仍然至关重要时。
常见影响 (1)
Confidentiality, Integrity, Access Control, Authentication, Authorization, OtherGain Privileges or Assume Identity, Bypass Protection Mechanism, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart, Quality Degradation, Reduce Maintainability
If an attacker can identify an exploitable vulnerability in one product that has no means of patching, the attack may be used against all affected versions of that product.
缓解措施 (4)
RequirementsSpecify requirements that each component should be updateable, including ROM, firmware, etc.
Architecture and DesignDesign the product to allow for updating of its components. Include the external infrastructure that might be necessary to support updates, such as distribution servers.
Architecture and Design, ImplementationWith hardware, support patches that can be programmed in-field or during manufacturing through hardware fuses. This feature can be used for limited patching of devices after shipping, or for the next batch of silicon devices manufactured, without changing the full device ROM.
Effectiveness: Moderate
ImplementationImplement the necessary functionality to allow each component to be updated.
代码示例 (2)
A refrigerator has an Internet interface for the official purpose of alerting the manufacturer when that refrigerator detects a fault. Because the device is attached to the Internet, the refrigerator is a target for hackers who may wish to use the device other potentially more nefarious purposes.
The refrigerator has no means of patching and is hacked, becoming a spewer of email spam.
Bad · Other
The device automatically patches itself and provides considerable more protection against being hacked.
Good · Other
A System-on-Chip (SOC) implements a Root-of-Trust (RoT) in ROM to boot secure code. However, at times this ROM code might have security vulnerabilities and need to be patched. Since ROM is immutable, it can be impossible to patch.
CVE ID标题CVSS风险等级Published
CVE-2026-21265 Microsoft Windows Secure Boot 安全漏洞 — Windows 10 Version 1607 6.4 Medium2026-01-13
CVE-2022-34381 Dell BSAFE 安全漏洞 — Dell BSAFE Crypto-J 9.1 Critical2024-02-02
CVE-2021-38398 Boston Scientific Zoom Latitude Programmer/Recorder/Monitor Model 3120 安全漏洞 — ZOOM LATITUDE 6.5 Medium2021-10-04

CWE-1329 是常见的弱点类别，本平台收录该类弱点关联的 3 条 CVE 漏洞。