Product Released in Non-Release Configuration

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when a product ships to customers while still configured with its pre-production or manufacturing settings, which typically include powerful debugging and testing features not intended for real-world use.

Extended Description

Products under development or in manufacturing are configured with extensive debug capabilities to aid engineers. These often include backdoors to bypass security checks (like authentication or encryption), commands to read or modify internal memory and registers, hidden administrative functions, and the ability to alter critical system configurations. These features, while necessary for testing, create severe security gaps if they remain accessible after the product ships. The risk is especially high in complex supply chains involving multiple vendors. For example, a chip manufacturer might test a component and then send it to an OEM for further testing before final production. The product is only considered secure for release after all testing is complete and a final lock-down step (like blowing a 'Manufacturing Complete' fuse) is performed. If this final step is missed, the product remains in its vulnerable, high-access manufacturing state, exposing end-users to potential attacks.

Common Consequences 1
Scope: ConfidentialityIntegrityAvailabilityAccess ControlAccountabilityAuthenticationAuthorizationNon-Repudiation

Impact: Other

Potential Mitigations 3
Phase: Implementation
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
Phase: Integration
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
Phase: Manufacturing
Ensure that there exists a marker for denoting the Manufacturing Complete stage and that the Manufacturing Complete marker gets updated at the Manufacturing Complete stage (i.e., the Manufacturing Complete fuse gets blown).
Demonstrative Examples 1
This example shows what happens when a preproduction system is made available for production.

Code Example:

Bad
Other

Suppose the chipmaker has a way of scanning all the internal memory (containing chipmaker-level secrets) during the manufacturing phase, and the way the chipmaker or the Original Equipment Manufacturer (OEM) marks the end of the manufacturing phase is by blowing a Manufacturing Complete fuse. Now, suppose that whoever blows the Manufacturing Complete fuse inadvertently forgets to execute the step to blow the fuse.

An attacker will now be able to scan all the internal memory (containing chipmaker-level secrets).

Code Example:

Good
Other

Blow the Manufacturing Complete fuse.

Observed Examples 2
CVE-2019-13945Regarding SSA-686531, a hardware based manufacturing access on S7-1200 and S7-200 SMART has occurred. A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-200 SMART CPU family (All versions). There is an access mode used during manufacturing of S7-1200 CPUs that allows additional diagnostic functionality. The security vulnerability could be exploited by an attacker with physical access to the UART interface during boot process. At the time of advisory publication, no public exploitation of this security vulnerability was known.
CVE-2018-4251Laptops with Intel chipsets were found to be running in Manufacturing Mode. After this information was reported to the OEM, the vulnerability (CVE-2018-4251) was patched disallowing access to the interface.
References 1
Intel ME's Undocumented Manufacturing Mode Suggests CPU Hacking Risks
Lucian Armasu
03-10-2018
ID: REF-1103
Applicable Platforms
Languages:
VHDL : UndeterminedVerilog : UndeterminedCompiled : Undetermined
Technologies:
Other : UndeterminedNot Technology-Specific : Undetermined
Modes of Introduction
Implementation
Integration
Manufacturing
Related Weaknesses