Common Weakness Enumeration

CWE-1246

Weakness Allowed

Improper Write Handling in Limited-write Non-Volatile Memories

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members
ChildOf: CWE-400 · View CWE-1000
Modes of introduction
Architecture and Design
Implementation
Content history
Submission: Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi · Intel Corporation · 2020-02-10 · CWE 4.0
Contribution: "Mapping CWE to 62443" Sub-Working Group · CWE-CAPEC ICS/OT SIG · 2023-04-25 · CWE 4.11

Suggested mappings to ISA/IEC 62443.

Contribution: James Lang · LDRA · 2024-04-23 · CWE 4.17

Suggested fix for broken 404 reference URL.

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Demonstrative_Examples, Description, Potential_Mitigations, Research_Gaps

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2022-06-28 · CWE 4.8

updated Applicable_Platforms

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Demonstrative_Examples, Relationships, Research_Gaps

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated References, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-04-03 · CWE 4.17

updated Demonstrative_Examples, References

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated References

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Common_Consequences, Description, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Background_Details, Description

2 vulnerabilities reference this CWE, most recent first.

GHSA-M325-8P6V-XM3F

Vulnerability from github – Published: 2023-06-15 12:30 – Updated: 2024-04-04 04:51
VLAI
Details

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-32229"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1246",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-15T11:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.",
  "id": "GHSA-m325-8p6v-xm3f",
  "modified": "2024-04-04T04:51:52Z",
  "published": "2023-06-15T12:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32229"
    },
    {
      "type": "WEB",
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QHPV-2VQR-F66V

Vulnerability from github – Published: 2024-07-15 21:31 – Updated: 2024-07-15 21:31
VLAI
Details

An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.

Severity
7.5 (High)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-36432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1246"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-15T19:15:02Z",
    "severity": "HIGH"
  },
  "details": "An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.",
  "id": "GHSA-qhpv-2vqr-f66v",
  "modified": "2024-07-15T21:31:06Z",
  "published": "2024-07-15T21:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36432"
    },
    {
      "type": "WEB",
      "url": "https://www.supermicro.com/en/support/security_center#%21advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.supermicro.com/zh_tw/support/security_BIOS_Jul_2024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design Implementation Testing

Include secure wear leveling algorithms and ensure they may not be bypassed.

CAPEC-212: Functionality Misuse

An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.

← Back to the CWE list