CWE-1242: Inclusion of Undocumented Features or Chicken Bits

Extended Description

A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

Code Examples & CVEs

Demonstrative Examples

Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented "special access features" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.

Remove all chicken bits and hidden features that are exposed to attackers. Add authorization schemes that rely on cryptographic primitives to access any features that the manufacturer does not want to expose. Clearly document all interfaces.

BadOther

Attackers dump the code from the device and then perform reverse engineering to analyze the code. The undocumented, special-access features are identified, and attackers can activate them by sending specific commands via UART before secure-boot phase completes. Using these hidden features, attackers can perform reads and writes to memory via the UART interface. At runtime, the attackers can also execute arbitrary code and dump the entire memory contents.

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-1242 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-1242, Inclusion of Undocumented Features or Chicken Bits, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Inclusion of Undocumented Features or Chicken Bits during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Implementation; recorded impacts include Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, and Bypass Protection Mechanism; the entry maps to CAPEC-212, and CAPEC-36. Use these source-defined anchors to turn CWE-1242 into implementation, review, and verification checks for the affected component.

CWE-1242: Inclusion of Undocumented Features or Chicken Bits — MITRE CWE

Triage CWE-1242 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1242, Inclusion of Undocumented Features or Chicken Bits, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-1242

Apply MITRE's full root-cause mapping guidance when using CWE-1242, Inclusion of Undocumented Features or Chicken Bits. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-1242 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-1242, Inclusion of Undocumented Features or Chicken Bits. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-1242: Inclusion of Undocumented Features or Chicken Bits?+

CWE-1242: Inclusion of Undocumented Features or Chicken Bits is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The device includes chicken bits or undocumented features that can create entry points for unauthorized actors. A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

What are the security consequences of Inclusion of Undocumented Features or Chicken Bits?+

If exploited, CWE-1242 (Inclusion of Undocumented Features or Chicken Bits) it can compromise Confidentiality, Integrity, Availability and Access Control, leading to outcomes such as Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity and Bypass Protection Mechanism.

How do you prevent or mitigate Inclusion of Undocumented Features or Chicken Bits?+

Recommended mitigations for CWE-1242 include: The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.

Which programming languages are affected by Inclusion of Undocumented Features or Chicken Bits?+

CWE-1242 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-1242 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-1242: Inclusion of Undocumented Features or Chicken Bits

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Effectiveness

Detection Methods