NIST 800-53 r5 · Controls catalogue · Family SC
SC-51Hardware-based Protection
Employ hardware-based, write-protect for {{ insert: param, sc-51_odp.01 }} ; and Implement specific procedures for {{ insert: param, sc-51_odp.02 }} to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 9,346 | Eliminates missing authorization for writes by requiring physical/hardware action under controlled procedures. |
CWE-284 | Improper Access Control | 5,367 | Hardware write-protect enforces access control on critical resources (e.g., firmware) independent of software state. |
CWE-434 | Unrestricted Upload of File with Dangerous Type | 4,993 | Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures. |
CWE-863 | Incorrect Authorization | 3,515 | Ensures authorization decisions for firmware changes cannot be bypassed by software and must follow explicit re-enable steps. |
CWE-732 | Incorrect Permission Assignment for Critical Resource | 1,874 | Directly implements hardware-enforced write protection on critical resources instead of relying on potentially incorrect software permissions. |
CWE-285 | Improper Authorization | 1,356 | Requires explicit authorization (via manual hardware procedures) before any write is possible, preventing unauthorized modifications. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-31649 | 7.0 | 9.8 | 0.0041 | good |
CVE-2025-47827 KEV UPD | 10.0 | 4.6 | 0.0382 | partial |
CVE-2025-31201 KEV UPD | 10.0 | 9.8 | 0.1236 | partial |
CVE-2024-56181 | 5.5 | 8.2 | 0.0020 | partial |
CVE-2025-47375 | 5.5 | 7.8 | 0.0007 | good |
CVE-2025-47398 | 5.5 | 7.8 | 0.0009 | good |