NIST 800-53 r5 · Controls catalogue · Family SC

SC-40Wireless Link Protection

Protect external and internal {{ insert: param, sc-40_prm_1 }} from the following signal parameter attacks: {{ insert: param, sc-40_prm_2 }}.

Last updated: 20 August 2026 13:14 UTC

Implementations targeting this control (0)

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE	Name	CVEs	Why this control addresses it
`CWE-200`	Exposure of Sensitive Information to an Unauthorized Actor	11,000+	Wireless link protection (encryption, directional transmission, etc.) directly prevents unauthorized actors from observing transmitted data.
`CWE-287`	Improper Authentication	5,200+	Requires authentication mechanisms on the wireless link, making improper authentication weaknesses harder to exploit.
`CWE-319`	Cleartext Transmission of Sensitive Information	1,000+	Mandates cryptographic protection of the wireless medium, eliminating cleartext transmission of sensitive information over the air.
`CWE-290`	Authentication Bypass by Spoofing	700+	Signal-parameter protections (e.g., cryptographic authentication, anti-spoofing) directly counter spoofing-based authentication bypass.
`CWE-294`	Authentication Bypass by Capture-replay	300+	Wireless link protections commonly incorporate replay protection, reducing the exploitability of capture-replay weaknesses.
`CWE-923`	Improper Restriction of Communication Channel to Intended Endpoints	69	Enforces that the wireless communication channel is usable only by intended endpoints, addressing improper channel restriction.
`CWE-300`	Channel Accessible by Non-Endpoint	55	The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints.

CVE	Risk	CVSS	EPSS	Match
No CVEs annotated to this control yet — the per-CVE backfill is in progress.