CWE-1320, Improper Protection for Outbound Error Messages and Alert Signals, covers hardware where untrusted agents can disable alerts about out of range conditions, or disable the mechanism that responds to them. It is a design concern for SoC and microcontroller teams.
How it happens
Hardware sensors check whether a device is running within design limits. The thresholds come from hardware fuses or trusted software such as a BIOS. When a sensor sees an out of bound condition, it raises an alert, and the response may be shutdown or throttling. Thermal and power sensor alerts are the examples MITRE gives.
The weakness appears when those alert signals are not properly secured. Untrusted software can mask them, or use them to generate spurious alerts.
What an attacker gains
The consequence in the record is availability: instability, crash, exit or restart, reduced reliability and an unexpected state. Masked alerts mean the device runs without its protection. Spurious alerts mean it throttles or shuts down for no reason, which is a denial of service.
How to find it
The record lists no detection methods. A useful review question is: which registers or interfaces can change alert thresholds or mask alerts, and who is allowed to write to them? Anything reachable by untrusted software is a finding.
How to fix it
MITRE's mitigation is short and clear. Alert signals generated by critical events should be protected from access by untrusted agents. Only hardware or trusted firmware modules should be able to alter the alert configuration.
Quick check
Which two attacker actions does this weakness allow?
Disabling alerts or the response mechanism that handles them, and generating spurious alerts that degrade performance or cause denial of service.
