CWE-1253 describes a design where the logic that sets a system to a secure state relies on a fuse being unblown. Chip designers choose that polarity once, and attackers get to exploit it for the life of the product.
How it happens
Fuses often hold secrets and security configuration. An unblown fuse reads as logic 0 and a blown fuse as logic 1. Fuses are generally one-directional: once blown to 1, they cannot be reset to 0.
That physical fact decides which way the security logic should point. If a secure state is the one where the fuse is at its default of 0, then anyone who can blow the fuse can drive the system into the insecure state.
MITRE's example is a chip that uses the sensed value of a fuse called do_secure_boot. If it reads 0, the chip performs secure boot. Otherwise it does not. An attacker blows the fuse to 1. After a reset, the attacker loads a custom bootloader, and because the fuse now says 1, secure boot is skipped. The attacker's firmware image runs.
The entry points out the economics. A fuse starts at 0 by default, so an attacker can blow it to 1 with inexpensive hardware. If the logic is reversed, the attacker cannot easily undo it. MITRE adds that with specialized and expensive equipment, an attacker with full physical access might still be able to unblow a fuse.
What an attacker gains
The record lists bypassing protection mechanisms, gaining privileges or assuming identity, reading and modifying memory, executing unauthorized code or commands, and denial of service through a crash or restart. If the logic uses negative polarity, an attacker might blow the fuse and push the system into an insecure state.
How to find it
The record has no detection methods. A review can go fuse by fuse:
- List each fuse that feeds a security decision.
- Write down what value means secure and what value means insecure.
- If the secure state needs the default value to be preserved, treat it as a finding.
- Ask what an attacker with cheap physical access could achieve by blowing it.
How to fix it
MITRE's mitigation at the design stage: build the logic so that blown fuses do not put the product into an insecure state that an attacker can use. In practice that means choosing polarity so the fuse's one-way change moves the device toward more security, not less.
Quick check
Why is a fuse that must stay unblown a bad security switch?
Because blowing is easy and one-directional. An attacker can blow the fuse with inexpensive hardware and the system drops into the insecure state.
Is a blown fuse permanently safe from reversal?
Not absolutely. MITRE notes that specialized, expensive equipment might let an attacker with full physical access unblow a fuse, though that is much harder.
