CWE-920, Improper Restriction of Power Consumption, applies when a product runs where power is limited and cannot be replenished by the product itself, but nothing limits how much power its operation uses. Think mobile phones, embedded devices and anything on a battery.
How it happens
Normal operation of an app uses power. The weakness is when an attacker can push usage beyond what was intended. MITRE names the components that can be abused: display, CPU, disk I/O, GPS, sound, microphone and the USB interface.
An example pattern: an app exposes a function that keeps the GPS active or the CPU busy in response to a remote request, with no cap and no timeout. Anyone who can trigger it can drain the battery.
What an attacker gains
The consequence is availability. MITRE says the power source could be drained, causing the application and the entire device to cease functioning. It also notes the cost angle: higher power use can raise the financial burden on the device owner.
How to find it
The record lists no detection methods and no observed CVEs. A practical approach is to measure. Run the app under hostile conditions, such as repeated triggers of every network or intent entry point, and watch power draw with the platform profiling tools.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Put a time limit and a rate limit on any feature that holds a power hungry component on.
- Release sensors such as GPS and microphone as soon as the task ends.
- Do not let unauthenticated callers start long running work.
Quick check
Which components does MITRE name as ways to drain power?
Display, CPU, disk I/O, GPS, sound, microphone and the USB interface.
