Re: speaking of hardware CVEs

[jericho <jericho@attrition.org>]

On Fri, 10 Mar 2017, Kurt Seifried wrote:

: This timely article is out: 
: 
https://www.cylance.com/en_us/blog/uefi-ransomware-full-disclosure-at-black-hat-asia.html
 
: seems like some UEFI implementations are lacking basic security 
: checks/best practices, I would think failing to sue those things 
should 
: be CVE worthy in the modern world.

Devil's advocate:

CVE has largely said they will not create for default credentials, even 
when it means complete administrative access to the app/device/OS [1]. 
If 
that isn't CVE-worthy, then "missing other best practices" doesn't seem 
like it would qualify either.

.b

[1] I realize there are a few default-related IDs, sometimes because 
researchers reserve it (e.g. CVE-2017-3186), a CNA assigns for it (e.g. 
CVE-2016-9215), or when MITRE assigns for it rarely (e.g. 
CVE-2016-6667).