CWE CATEGORY: ICS Dependencies (& Architecture): External Digital Systems
|
Category ID: 1368
Vulnerability Mapping:
PROHIBITED
This CWE ID must not be used to map to real-world vulnerabilities
|
 Summary
Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Membership
| Nature |
Type |
ID |
Name |
| MemberOf |
 Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1360 |
ICS Dependencies (& Architecture)
|
| HasMember |
 Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
15 |
External Control of System or Configuration Setting
|
| HasMember |
 Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
287 |
Improper Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
306 |
Missing Authentication for Critical Function
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
308 |
Use of Single-factor Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
312 |
Cleartext Storage of Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
440 |
Expected Behavior Violation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
470 |
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
603 |
Use of Client-Side Authentication
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
610 |
Externally Controlled Reference to a Resource in Another Sphere
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
638 |
Not Using Complete Mediation
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1059 |
Insufficient Technical Documentation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1068 |
Inconsistency Between Implementation and Documented Design
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1104 |
Use of Unmaintained Third Party Components
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1329 |
Reliance on Component That is Not Updateable
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1357 |
Reliance on Insufficiently Trustworthy Component
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1393 |
Use of Default Password
|
Vulnerability Mapping Notes
|
Usage:
PROHIBITED
(this CWE ID must not be used to map to real-world vulnerabilities)
|
|
Reason:
Category
|
|
Rationale:
This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
|
|
Comments: See member weaknesses of this category.
|
Notes
Relationship
Relationships in this category are not authoritative and subject to change. See Maintenance notes.
Maintenance
This category was created in CWE 4.7 to facilitate and illuminate discussion about weaknesses in ICS with [ REF-1248] as a starting point. After the release of CWE 4.9 in October 2022, this has been under active review by members of the "Boosting CWE" subgroup of the CWE-CAPEC ICS/OT Special Interest Group (SIG). Relationships are still subject to change. In addition, there may be some issues in [ REF-1248] that are outside of the current scope of CWE, which will require consultation with many CWE stakeholders to resolve.
References
Content
History
| Submissions |
| Submission Date |
Submitter |
Organization |
2022-03-09
(CWE 4.7, 2022-04-28)
|
New Categories of Security Vulnerabilities (NCSV) Technical Project Team (TPT) |
Securing Energy Infrastructure Executive Task Force |
|
|
| Contributions |
| Contribution Date |
Contributor |
Organization |
2023-06-29
(CWE 4.12, 2023-06-29)
|
"Boosting CWE Content" Sub-Working Group |
CWE-CAPEC ICS/OT SIG |
|
Suggested weaknesses to add to this category.
|
2023-01-24
(CWE 4.10, 2023-01-24)
|
"Boosting CWE Content" Sub-Working Group |
CWE-CAPEC ICS/OT SIG |
|
Suggested weaknesses to add to this category.
|
 Modifications |
| Modification Date |
Modifier |
Organization |
2025-09-09
(CWE 4.18, 2025-09-09)
|
CWE Content Team |
MITRE |
|
updated References
|
2023-06-29
(CWE 4.12, 2023-06-29)
|
CWE Content Team |
MITRE |
|
updated Mapping_Notes, Relationships
|
2023-04-27
(CWE 4.11, 2023-04-27)
|
CWE Content Team |
MITRE |
|
updated Mapping_Notes
|
2023-01-31
(CWE 4.10, 2023-01-31)
|
CWE Content Team |
MITRE |
|
updated Description, Maintenance_Notes, Relationship_Notes, Relationships
|
More information is available — Please edit the custom filter or select a different filter.
|
