CAPEC-681
Exploitation of Improperly Controlled Hardware Security Identifiers
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.
On this page
A System-on-Chip (SoC) often implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, these mechanisms may be exploitable due to any number of the following:
- The security identifiers are missing
- The security identifiers are incorrectly implemented or generated
- The security identifiers are generated with an obsolete encoding
- The security identifiers are generated and implemented correctly, but are improperly protected
If the security identifiers leveraged by the SoC are missing or misconfigured, an adversary may be able to take advantage of this shortcoming to circumvent the intended access controls. This could result in the adversary gaining unintended access, performing a Denial of Service (DoS), escalating privileges, or spoofing actions from a trusted agent.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/681.html and https://cve.bz/cve/capec/681?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
Awareness of the hardware being leveraged.
Access to the hardware being leveraged.
Skills required
- Medium skill
Ability to execute actions within the SoC.
- High skill
Intricate knowledge of the identifiers being utilized.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Read Data | Confidentiality | |
| Gain Privileges | Confidentiality, Access Control, Authorization |
Mitigations
Review generation of security identifiers for design inconsistencies and common weaknesses.
Review security identifier decoders for design inconsistencies and common weaknesses.
Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.
Weaknesses it exploits
- CWE-1259 Improper Restriction of Security Token Assignment
- CWE-1267 Policy Uses Obsolete Encoding
- CWE-1270 Generation of Incorrect Security Tokens
- CWE-1294 Insecure Security Identifier Mechanism
- CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
Recent CVEs with these weaknesses
- 8.8CVE-2026-16716
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token a…
- 6.5CVE-2026-117635
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses…
- 8.2CVE-2026-76413
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerabili…
- 6.0CVE-2026-19636
An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation.
- 4.9CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
- 7.5CVE-2026-24084
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
- 4.3CVE-2026-15831
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance pol…
- 8.1CVE-2026-54593
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
A system contains a register (divided into four 32-bit registers) that is used to store a 128-bit AES key for…
A system contains a register (divided into four 32-bit registers) that is used to store a 128-bit AES key for encryption/decryption, in addition to an access-policy register. The access-policy register determines which agents may access the AES-key registers, based on a corresponding security identifier. It is assumed the system has two agents: a Main-controller and an Aux-controller, with respective security identifiers "1" and "2". The Main-controller (ID "1") is meant to have access to the AES-key registers, while the Aux-controller (ID "2") has access to the access-policy register. If a SoC incorrectly generates security identifier "1" for both agents, then both agents will have access to the AES-key registers. This could further result in a Denial-of-Service (DoS) or the execution of an action that in turn could result in privilege escalation or unintended access.
MITRE's words, unchanged: CAPEC-681 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.