NIST 800-53 r5 · Controls catalogue · Family SC
SC-40Wireless Link Protection
Protect external and internal {{ insert: param, sc-40_prm_1 }} from the following signal parameter attacks: {{ insert: param, sc-40_prm_2 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (1)
- T1557.004 Evil Twin Credential Access, Collection
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Wireless link protection (encryption, directional transmission, etc.) directly prevents unauthorized actors from observing transmitted data. |
CWE-287 | Improper Authentication | 4,908 | Requires authentication mechanisms on the wireless link, making improper authentication weaknesses harder to exploit. |
CWE-319 | Cleartext Transmission of Sensitive Information | 1,076 | Mandates cryptographic protection of the wireless medium, eliminating cleartext transmission of sensitive information over the air. |
CWE-290 | Authentication Bypass by Spoofing | 698 | Signal-parameter protections (e.g., cryptographic authentication, anti-spoofing) directly counter spoofing-based authentication bypass. |
CWE-294 | Authentication Bypass by Capture-replay | 280 | Wireless link protections commonly incorporate replay protection, reducing the exploitability of capture-replay weaknesses. |
CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | 61 | Enforces that the wireless communication channel is usable only by intended endpoints, addressing improper channel restriction. |
CWE-300 | Channel Accessible by Non-Endpoint | 54 | The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-65552 | 7.0 | 9.8 | 0.0040 | good |
CVE-2025-1727 UPD | 5.5 | 8.1 | 0.0053 | good |
CVE-2026-26048 | 5.5 | 7.5 | 0.0026 | good |
CVE-2025-52435 | 5.5 | 7.5 | 0.0021 | good |
CVE-2026-23808 | 3.5 | 5.4 | 0.0026 | good |
CVE-2025-69969 | 7.0 | 9.6 | 0.0046 | good |
CVE-2025-24836 | 5.5 | 7.1 | 0.0023 | good |
CVE-2025-69821 | 5.5 | 7.4 | 0.0041 | good |
CVE-2025-36911 | 5.5 | 7.1 | 0.0694 | good |
CVE-2025-14346 | 7.0 | 9.8 | 0.0549 | partial |
CVE-2025-20634 | 7.0 | 9.8 | 0.0074 | partial |
CVE-2025-30139 | 7.0 | 9.8 | 0.0039 | partial |
CVE-2024-20017 UPD | 7.0 | 9.8 | 0.4633 | partial |
CVE-2022-20145 | 7.0 | 9.8 | 0.0645 | partial |
CVE-2023-27746 | 7.0 | 9.8 | 0.0175 | partial |
CVE-2024-20154 | 5.5 | 8.8 | 0.0394 | partial |
CVE-2024-20153 | 5.5 | 7.5 | 0.0032 | partial |
CVE-2025-62235 | 5.5 | 8.1 | 0.0037 | partial |
CVE-2025-69822 | 5.5 | 7.4 | 0.0034 | good |
CVE-2025-47383 | 5.5 | 7.2 | 0.0013 | partial |
CVE-2024-30078 | 5.5 | 8.8 | 0.0516 | partial |
CVE-2026-23809 | 3.5 | 5.4 | 0.0026 | partial |