CAPEC-625
Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-625: Mobile Device Fault Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/625.html and https://cve.bz/cve/capec/625?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Skills required
- High skill
Adversaries require non-trivial technical skills to create and implement fault injection attacks on mobile devices. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required. This prerequisite makes the attack challenging to perform (assuming that physical security countermeasures and monitoring are in place).
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality, Access Control | Extract long-term secret keys (e.g. keys used for VPN or WiFi authentication and encryption) to enable decryption of intercepted VOIP traffic. |
Mitigations
Strong physical security of all devices that contain secret key information. (even when devices are not in use)
Frequent changes to secret keys and certificates.
Weaknesses it exploits
- CWE-1247 Improper Protection Against Voltage and Clock Glitches
- CWE-1248 Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
- CWE-1256 Improper Restriction of Software Interfaces to Hardware Features
- CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI)
- CWE-1332 Improper Handling of Faults that Lead to Instruction Skips
- CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy
- CWE-1338 Improper Protections Against Hardware Overheating
- CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments
Recent CVEs with these weaknesses
- 6.8CVE-2026-90891
ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restrict…
- 5.8CVE-2026-75811
Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing cri…
- 7.3CVE-2026-18349
Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.
- 9.3CVE-2018-25159
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers ca…
- 8.6CVE-2025-54520
Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platform resulting in a loss of confidentiality.
- 8.6CVE-2025-9709
On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRF52810 allow attacker to perform EM Fault Injection and bypass APPROTECT at run…
- 7.3CVE-2024-5477
A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that re…
- 9.8CVE-2025-8028
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firef…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-624 Hardware Fault Injection
MITRE's words, unchanged: CAPEC-625 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.