CWE-920 — Vulnerability Class 1

CWE-920 represents a resource management weakness where software fails to adequately limit its power consumption in environments with finite energy sources, such as battery-operated mobile or embedded devices. This flaw is typically exploited not through malicious intent, but by the system’s own inefficient operations, leading to rapid battery depletion, unexpected shutdowns, or thermal throttling that degrades performance. Attackers may leverage this by triggering high-power processes to induce denial-of-service conditions, effectively draining the device’s power supply to disrupt service. To prevent this, developers must implement robust power management strategies, including optimizing code efficiency, utilizing hardware-specific power-saving modes, and enforcing strict limits on background processes. Regular profiling and testing under varying load conditions ensure that energy usage remains within sustainable bounds, preserving device longevity and operational reliability.