The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.

The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.

The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.

The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.

On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.

Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

During installation, installed file permissions are set to allow anyone to modify those files.

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.