CWE-1269 covers a product released to market while still in its pre-production or manufacturing configuration. It hits hardware vendors, OEMs and anyone who assembles devices in several stages.
How it happens
Products in pre-production or manufacturing are set up with many debug hooks and capabilities. MITRE lists several: overriding or bypassing cryptographic checks including authentication, authorization and integrity, reading, writing and dumping internal state such as registers and memory, changing system configuration, and running hidden commands that are disallowed in production because they expose intellectual property.
Complexity grows with the number of parties. A chipmaker may fabricate a chip and run its own pre-production tests. The chip then goes to the OEM, which runs a second set. Only after both are done can manufacturing be called complete and the "Manufacturing Complete" fuse be blown. If the OEM forgets to blow that fuse, the system stays in the manufacturing stage, exposed and vulnerable.
Two recorded cases show it in practice. CVE-2019-13945 describes hardware based manufacturing access on SIMATIC S7-1200 and S7-200 SMART CPUs. CVE-2018-4251 covers laptops with Intel chipsets found running in Manufacturing Mode, which was patched to disallow access.
What an attacker gains
The record rates the impact high across confidentiality, integrity, availability, access control, accountability, authentication, authorization and non-repudiation. A device in manufacturing mode offers the attacker the same debug powers the factory used.
How to find it
The record lists no detection methods. A practical check is to audit a sample of finished units from the production line. Query the device state and confirm the manufacturing complete indicator is set and debug interfaces behave as in production.
How to fix it
- Treat the final lock step, such as blowing the fuse, as a release gate with a named owner.
- Verify the lock on finished units before shipment, not just on the process documentation.
- When several companies test the same part, define clearly who performs the final step and how it is confirmed.
- Build the check into automated end of line test so a missed step fails the unit.
Quick check
What single missed step can cause this?
Not blowing the Manufacturing Complete fuse after the last round of pre-production testing.
