NIST 800-53 r5 · Controls catalogue · Family SC
SC-25Thin Nodes
Employ minimal functionality and information storage on the following system components: {{ insert: param, sc-25_odp }}.
Last updated: 16 October 2026 10:19 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 11,700+ | Minimal information storage directly reduces the quantity of sensitive data resident on the component that could be exposed. |
CWE-250 | Execution with Unnecessary Privileges | 300+ | Minimal functionality inherently eliminates execution of unneeded code paths and associated privileges. |
CWE-749 | Exposed Dangerous Method or Function | 200+ | Minimal functionality removes or avoids exposure of dangerous methods and functions. |
CWE-489 | Active Debug Code | 100+ | Minimal functionality precludes inclusion of active debug code or diagnostic interfaces. |
CWE-506 | Embedded Malicious Code | 100+ | Reduced code footprint and storage make insertion or persistence of embedded malicious code far less feasible. |
CWE-912 | Hidden Functionality | 89 | Constrained functionality and storage surface leave little room for hidden or undocumented functionality. |
CWE-1104 | Use of Unmaintained Third Party Components | 31 | Fewer components and services mean reduced attack surface from unmaintained third-party code. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2024-5386 UPD | 6.6 | 8.8 | 0.0054 | good |
CVE-2023-49722 UPD | 6.3 | 8.3 | 0.0044 | good |