NIST SP 800-53 rev5 · Configuration Management

CM-11 User-installed Software

Mitigates 33 ATT&CK techniques, used by 10 threats in this month's news.

Control text and guidance at NIST

Why it matters this month

Threats in SecurityTabs news using techniques this control mitigates.

Weaknesses it helps against

Through the techniques typically used to exploit them (CTID, CISA KEV).

CWE-772 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
CWE-782 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
CWE-201 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
CWE-4161 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
CWE-4341 techniquesUnrestricted Upload of File with Dangerous TypeUploads aren't restricted, so an attacker uploads a script (a web shell) and then requests it.

Techniques it mitigates

The 30 most used of 33, by how many ATT&CK groups and malware use them.

Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.