cve.bz

CWE-1282: Assumed-Immutable Data is Stored in Writable Memory

Filter

Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration settings are stored in writable memory that can be re-programmed or updated in the field.

What the weakness is: CWE-1282 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-458 Flash Memory Attacks
  • CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections Likelihood: Medium · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-1282, as MITRE names them. Credits.

Ask an AI about CWE-1282

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1282: Assumed-Immutable Data is Stored in Writable Memory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1282.html and https://cve.bz/cve/cwe/1282?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2018-25229EPSS 0.2%

    BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the SMTP configuration interface that allows local attackers to crash the application by supplying an oversized string. Attackers can input a buffer of 257 'A…

  2. 6.9CVE-2019-25590EPSS 0.2%

    Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by supplying an excessively long string in the log file name field. Attackers can enable session loggin…

  3. 6.9CVE-2019-25588EPSS 0.2%

    BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash the application by supplying an excessively long string. Attackers can enable the DNS Address optio…

  4. 6.9CVE-2019-25587EPSS 0.2%

    BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the Storage-Path configuration parameter that allows local attackers to crash the application by supplying an excessively long string value. Attackers can ena…

  5. 6.9CVE-2019-25583EPSS 0.2%

    RarmaRadio 2.72.3 contains a denial of service vulnerability in the Username field that allows local attackers to crash the application by submitting excessively long input. Attackers can paste a buffer of 5000 bytes into the Username fiel…

  6. 6.9CVE-2019-25551EPSS 0.2%

    Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Program Alerts configuration field. Attackers can paste a buffer of 5000 characte…

  7. 8.7CVE-2019-25358EPSS 0.4%

    FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-…

  8. 7.1CVE-2022-2483EPSS 0.2%

    The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an attacker modifies the flash contents to corrupt the keys, secure boot could be perm…