CWEweakness
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
- Abstraction
- Base
- Structure
- Simple
- Status
- Stable
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
Extended description
If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface.
Common consequences
• Confidentiality: Read Application Data
• Confidentiality: Read Memory
• Authorization: Execute Unauthorized Code or Commands
• Integrity: Modify Memory
• Integrity: Modify Application Data
• Access Control: Bypass Protection Mechanism
Potential mitigations
• [Architecture and Design] If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.
Detection methods
• Dynamic Analysis with Manual Results Interpretation: Authentication and authorization of debug and test interfaces should be part of the architecture and design review process. Withholding of private register documentation from the debug and test interface public specification ("Security by obscurity") should not be considered as sufficient security.
• Dynamic Analysis with Manual Results Interpretation: Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug and test interfaces are not open by default.
• Fuzzing: Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate authentication and authorization is possible.
Observed examples
• CVE-2019-18827: Chain: JTAG interface is not disabled (CWE-1191) during ROM code execution, introducing a race condition (CWE-362) to extract encryption keys
Related
Attack pattern · CAPEC (2)
Observed example · CVE (1)
- CVE-2019-18827 On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. vulnerability
Child of · CWE (1)
- CWE-284 Improper Access Control weakness
Referenced by CAPEC · weakness (2)
Referenced by CVE · weakness (29)
- CVE-2026-102370 Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the… vulnerability
- CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. vulnerability
- CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. vulnerability
- CVE-2026-80357 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access… vulnerability
- CVE-2026-80358 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access… vulnerability
- CVE-2026-80359 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access… vulnerability
- CVE-2026-15203 Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers… vulnerability
- CVE-2026-8988 Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and… vulnerability
- CVE-2026-8989 Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware… vulnerability
- CVE-2024-36319 Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command… vulnerability
- CVE-2025-52533 Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially… vulnerability
- CVE-2025-15083 A vulnerability was determined in TOZED ZLT M30s up to 1.47. vulnerability
- CVE-2025-36755 The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating… vulnerability
- CVE-2025-65821 As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and… vulnerability
- CVE-2025-65822 The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. vulnerability
- CVE-2025-12114 Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2:… vulnerability
- CVE-2025-9709 On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in… vulnerability
- CVE-2025-7213 A vulnerability classified as critical has been found in FNKvision FNK-GU2 up to 40.1.7. vulnerability
- CVE-2025-47819 Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. vulnerability
- CVE-2025-47822 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. vulnerability
- CVE-2025-48468 Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify… vulnerability
- CVE-2025-26408 The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. vulnerability
- CVE-2025-26409 A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. vulnerability
- CVE-2024-48970 The ventilator's microcontroller lacks memory protection. vulnerability
- CVE-2024-41692 This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without… vulnerability
- CVE-2024-4231 This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal… vulnerability
- CVE-2023-32666 On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or… vulnerability
- CVE-2022-43096 Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. vulnerability
- CVE-2020-9285 Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be… vulnerability