CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)

Definition

What is CWE-1319?

This vulnerability occurs when a hardware device lacks sufficient shielding against electromagnetic interference, allowing attackers to disrupt its internal operations. By inducing targeted electromagnetic pulses, an attacker can force the device to malfunction, potentially bypassing security checks or leaking sensitive data.

Electromagnetic Fault Injection (EM-FI) is a physical attack where an attacker uses a controlled electromagnetic pulse near a device's integrated circuit. This pulse induces unexpected currents in the chip's wiring, temporarily disrupting normal execution. This manipulation can force the hardware into an erroneous state, allowing an attacker to influence its behavior during critical security operations. Successful EM-FI attacks can have severe consequences, including bypassing secure boot or debug locks, altering program execution to skip authentication, leaking cryptographic keys or other secrets from memory, and corrupting the output of security-critical components like hardware random number generators. These faults are highly localized and precise, often requiring specialized equipment but posing a significant threat to devices accessible to an attacker with physical access.

Real-world impact

Real-world CVEs caused by CWE-1319

CVE-2020-27211

Chain: microcontroller system-on-chip uses a register value stored in flash to set product protection state on the memory bus and does not contain protection against fault injection (CWE-1319) which leads to an incorrect initialization of the memory bus (CWE-1419) causing the product to be in an unprotected state.

How attackers exploit it

Step-by-step attacker path

1
Identify a code path that handles untrusted input without validation.
2
Craft a payload that exercises the unsafe behavior — injection, traversal, overflow, or logic abuse.
3
Deliver the payload through a normal request and observe the application's reaction.
4
Iterate until the response leaks data, executes attacker code, or escalates privileges.

Vulnerable code example

Vulnerable pseudo

MITRE has not published a code example for this CWE. The pattern below is illustrative — see Resources for canonical references.

Vulnerable pseudo

// Example pattern — see MITRE for the canonical references.
function handleRequest(input) {
  // Untrusted input flows directly into the sensitive sink.
  return executeUnsafe(input);
}

Secure code example

Secure pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Prevention checklist

How to prevent CWE-1319

Architecture and Design / Implementation - 1. Redundancy - By replicating critical operations and comparing the two outputs can help indicate whether a fault has been injected. - 2. Error detection and correction codes - Gay, Mael, et al. proposed a new scheme that not only detects faults injected by a malicious adversary but also automatically corrects single nibble/byte errors introduced by low-multiplicity faults. - 3. Fail by default coding - When checking conditions (switch or if) check all possible cases and fail by default because the default case in a switch (or the else part of a cascaded if-else-if construct) is used for dealing with the last possible (and valid) value without checking. This is prone to fault injection because this alternative is easily selected as a result of potential data manipulation [REF-1141]. - 4. Random Behavior - adding random delays before critical operations, so that timing is not predictable. - 5. Program Flow Integrity Protection - The program flow can be secured by integrating run-time checking aiming at detecting control flow inconsistencies. One such example is tagging the source code to indicate the points not to be bypassed [REF-1147]. - 6. Sensors - Usage of sensors can detect variations in voltage and current. - 7. Shields - physical barriers to protect the chips from malicious manipulation.

Detection signals

How to detect CWE-1319

SAST High

Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.

DAST Moderate

Run dynamic application security testing against the live endpoint.

Runtime Moderate

Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.

Code review Moderate

Code review: flag any new code that handles input from this surface without using the validated framework helpers.

CWE-1319

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Frequently asked questions

What is CWE-1319?

This vulnerability occurs when a hardware device lacks sufficient shielding against electromagnetic interference, allowing attackers to disrupt its internal operations. By inducing targeted electromagnetic pulses, an attacker can force the device to malfunction, potentially bypassing security checks or leaking sensitive data.

How serious is CWE-1319?

MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.

What languages or platforms are affected by CWE-1319?

MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, System on Chip, Microcontroller Hardware, Memory Hardware, Power Management Hardware, Processor Hardware, Test/Debug Hardware.

How can I prevent CWE-1319?

- 1. Redundancy - By replicating critical operations and comparing the two outputs can help indicate whether a fault has been injected. - 2. Error detection and correction codes - Gay, Mael, et al. proposed a new scheme that not only detects faults injected by a malicious adversary but also automatically corrects single nibble/byte errors introduced by low-multiplicity faults. - 3. Fail by default coding - When checking conditions (switch or if) check all possible cases and fail by default…

How does Plexicus detect and fix CWE-1319?

Plexicus's SAST engine matches the data-flow signature for CWE-1319 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.

Where can I learn more about CWE-1319?

MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/1319.html. You can also reference OWASP and NIST documentation for adjacent guidance.

Related weaknesses

Weaknesses related to CWE-1319

CWE-693 Parent

Ready to validate what matters?

Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.

Request AI Swarm Pentest

Improper Protection against Electromagnetic Fault Injection (EM-FI)

What is CWE-1319?

Real-world CVEs caused by CWE-1319

Step-by-step attacker path

Vulnerable pseudo

Secure pseudo

How to prevent CWE-1319

How to detect CWE-1319

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-1319

Protection Mechanism Failure

Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Semiconductor Defects in Hardware Logic with Security-Sensitive Implications

Incorrect Selection of Fuse Values

Product Released in Non-Release Configuration

Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques

Public Key Re-Use for Signing both Debug and Production Code

Missing Support for Security Features in On-chip Fabrics or Buses

Missing Immutable Root of Trust in Hardware

Further reading

Ready to validate what matters?

Check whether AI Swarm Pentest fits your environment.

Request received. Book the next step.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`