NIST 800-53 r5 · Controls catalogue · Family SC
SC-34Non-modifiable Executable Programs
For {{ insert: param, sc-34_odp.01 }} , load and execute: The operating environment from hardware-enforced, read-only media; and The following applications from hardware-enforced, read-only media: {{ insert: param, sc-34_odp.02 }}.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (15)
- T1195.003 Compromise Hardware Supply Chain Initial Access
- T1218.015 Electron Applications Stealth
- T1542 Pre-OS Boot Stealth, Persistence
- T1542.001 System Firmware Stealth, Persistence
- T1542.003 Bootkit Stealth, Persistence
- T1542.004 ROMMONkit Stealth, Persistence
- T1542.005 TFTP Boot Stealth, Persistence
- T1548 Abuse Elevation Control Mechanism Privilege Escalation
- T1548.004 Elevated Execution with Prompt Privilege Escalation
- T1553 Subvert Trust Controls Defense Impairment
- T1553.006 Code Signing Policy Modification Defense Impairment
- T1601 Modify System Image Defense Impairment
- T1601.001 Patch System Image Defense Impairment
- T1601.002 Downgrade System Image Defense Impairment
- T1611 Escape to Host Privilege Escalation
Weaknesses this control addresses (5)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-94 | Improper Control of Generation of Code ('Code Injection') | 6,984 | Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media. |
CWE-284 | Improper Access Control | 5,367 | Hardware-enforced read-only media directly implements strong access control preventing any modification of executables. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Overrides or renders irrelevant incorrect permission assignments on critical executable resources by using hardware-level immutability. |
CWE-506 | Embedded Malicious Code | 85 | Prevents embedding or persistence of malicious code in the OS or specified applications since the media cannot be written. |
CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') | 23 | Eliminates the possibility of static code injection into saved executables by making the storage non-modifiable. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2016-20024 UPD | 7.0 | 9.8 | 0.0073 | good |
CVE-2025-41660 | 5.5 | 8.8 | 0.0043 | good |
CVE-2026-24063 | 5.5 | 8.2 | 0.0013 | good |
CVE-2025-0834 | 5.5 | 7.8 | 0.0015 | good |
CVE-2026-2123 | 5.5 | 7.8 | 0.0010 | good |
CVE-2020-36938 | 5.5 | 8.8 | 0.0020 | good |
CVE-2020-36916 | 5.5 | 8.8 | 0.0022 | good |
CVE-2016-20033 | 5.5 | 7.8 | 0.0021 | good |
CVE-2019-25344 | 5.5 | 7.8 | 0.0016 | good |
CVE-2021-47761 | 5.5 | 7.8 | 0.0009 | good |
CVE-2022-50931 | 5.5 | 7.8 | 0.0019 | good |
CVE-2019-25343 | 5.5 | 7.8 | 0.0011 | good |
CVE-2020-37129 | 7.0 | 9.8 | 0.0034 | good |
CVE-2024-45555 | 5.5 | 8.4 | 0.0014 | good |
CVE-2026-32979 | 5.5 | 7.3 | 0.0013 | good |
CVE-2025-15561 | 5.5 | 7.8 | 0.0010 | good |
CVE-2026-32009 | 3.5 | 5.7 | 0.0013 | good |
CVE-2026-30283 | 7.0 | 9.8 | 0.0053 | good |
CVE-2022-30315 | 7.0 | 9.8 | 0.0076 | partial |
CVE-2024-42444 | 5.5 | 7.5 | 0.0012 | good |
CVE-2016-20025 UPD | 5.5 | 8.8 | 0.0044 | good |
CVE-2025-10314 | 5.5 | 8.8 | 0.0015 | good |