cve.bz

CWE-1326: Missing Immutable Root of Trust in Hardware

Filter

A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.

What the weakness is: CWE-1326 at MITRE. All weaknesses

Related attack patterns (CAPEC): 2
  • CAPEC-68 Subvert Code-signing Facilities Likelihood: Low · Severity: Very High
  • CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections Likelihood: Medium · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-1326, as MITRE names them. Credits.

Ask an AI about CWE-1326

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1326: Missing Immutable Root of Trust in Hardware and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1326.html and https://cve.bz/cve/cwe/1326?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2025-34503EPSS 0.1%

    Deck Mate 1 executes firmware directly from an external EEPROM without verifying authenticity or integrity. An attacker with physical access can replace or reflash the EEPROM to run arbitrary code that persists across reboots. Because this…

  2. 7.0CVE-2025-34502EPSS 0.2%

    Deck Mate 2 lacks a verified secure-boot chain and runtime integrity validation for its controller and display modules. Without cryptographic boot verification, an attacker with physical access can modify or replace the bootloader, kernel,…

  3. 7.8CVE-2025-5834EPSS 0.3%

    Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Alth…

  4. 4.1CVE-2025-31929EPSS 0.2%

    A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions), IEC 1Ph 7.4kW Parent cable 7m (8EM1310-2EJ04-3GA1) (All version…

  5. 7.8CVE-2025-2762EPSS 0.2%

    CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtai…

  6. 7.8CVE-2024-8357EPSS 0.3%

    Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. …

  7. 7.5CVE-2024-30111EPSS 0.3%

    HCL DRYiCE AEX product is impacted by Missing Root Detection vulnerability in the mobile application. The mobile app can be installed in the rooted device due to which malicious users can gain unauthorized access to the rooted devices, co…

  8. 7.6CVE-2024-32742EPSS 0.4%

    A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operatin…

  9. 6.8CVE-2022-38773EPSS 0.3%

    Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to repl…