CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
How it's found
Improper Protection for Outbound Error Messages and Alert Signals is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Hardware sensors are used to detect whether a device is operating within design limits. The threshold values for these limits are set by hardware fuses or trusted software such as a BIOS. Modification of these limits may be protected by hardware mechanisms. When device sensors detect out of bound conditions, alert signals may be generated for remedial action, which may take the form of device shutdown or throttling. Warning signals that are not properly secured may be disabled or used to generate spurious alerts, causing degraded performance or denial-of-service (DoS). These alerts may be masked by untrusted software. Examples of these alerts involve thermal and power sensor alerts.
Vulnerable vs. safe
The processor-GPIO controller exposes software-programmable controls that allow untrusted software to reprogram the state of the GPIO pin.The GPIO alert-signal pin is blocked from untrusted software access and is controlled only by trusted software, such as the System BIOS.Consequences
- DoS: Instability, DoS: Crash, Exit, or Restart, Reduce Reliability, Unexpected State
Mitigations
- Architecture and Design: Alert signals generated by critical events should be protected from access by untrusted agents. Only hardware or trusted firmware modules should be able to alter the alert configuration.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-1320?
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
How do you find Improper Protection for Outbound Error Messages and Alert Signals?
Improper Protection for Outbound Error Messages and Alert Signals is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1320?
DoS: Instability, DoS: Crash, Exit, or Restart, Reduce Reliability, Unexpected State
Does TurboPentest test for Improper Protection for Outbound Error Messages and Alert Signals?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest