CWE-1266 describes a product that does not give its administrator a proper way to remove sensitive data when the product is decommissioned. The scrubbing capability might be missing, too weak, or simply wrong. Anyone who later gets hold of the retired device can read what was left behind.
This matters to device makers, firmware teams, and to any company that retires routers, appliances, laptops or embedded gear and then sells, recycles or discards it.
How it happens
When a product leaves service, best practice or regulation may require the administrator to remove or overwrite sensitive data first. That step is called scrubbing. The weakness appears when the product offers no scrubbing function, offers one that leaves data behind, or offers one that does not do what its label says.
MITRE lists the kinds of data at risk: proprietary information from the device or its manufacturer, user and device credentials, network configurations, and other sensitive material.
What an attacker gains
The recorded consequence is a confidentiality loss through reading memory. A malicious actor who acquires the decommissioned device can pull out whatever the scrub missed, such as credentials or network layout, and use it against the previous owner.
How to find it
The record lists no formal detection methods, so this comes down to testing the retirement path itself.
- Read the decommissioning procedure in the product documentation. If there is none, that is the finding.
- Run the documented wipe on a test unit, then inspect storage and memory for credentials, keys and configuration.
- Check that the scrub covers every place the device keeps state, not just the main file system.
How to fix it
Treat decommissioning as a feature with requirements, not an afterthought.
- Provide an administrator facing scrub function in every product that stores secrets.
- Make it cover credentials, network configuration and any vendor proprietary data.
- Verify the result with a read back test before the device is released for disposal.
- Document the procedure so operators actually run it.
Quick check
Is a factory reset enough?
Only if it removes all sensitive data, including credentials and network configuration. CWE-1266 includes scrubbing that is insufficient or incorrect, so verify the result instead of trusting the button.
