How do you prevent CAPEC-625?

Strong physical security of all devices that contain secret key information. (even when devices are not in use)

What weaknesses does CAPEC-625 target?

CAPEC-625 exploits 8 CWE weaknesses, including CWE-1247 (Improper Protection Against Voltage and Clock Glitches), CWE-1248 (Semiconductor Defects in Hardware Logic with Security-Sensitive Implications), CWE-1256 (Improper Restriction of Software Interfaces to Hardware Features), CWE-1319 (Improper Protection against Electromagnetic Fault Injection (EM-FI)).

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Standard attack pattern

Draft

CAPEC-625: Mobile Device Fault Injection

Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Last updated June 1, 2026

Not rated

Typical severity

Per MITRE

Not rated

Likelihood of attack

Per MITRE

8

Related weaknesses

CWEs this targets

Standard

Abstraction

MITRE classification

Overview

CAPEC-625 (Mobile Device Fault Injection) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.

What the attacker needs

Skills required

High skill: Adversaries require non-trivial technical skills to create and implement fault injection attacks on mobile devices. Although this style of attack has become easier (commercial equipment and training classes are available to perform these attacks), they usual require significant setup and experimentation time during which physical access to the device is required. This prerequisite makes the attack challenging to perform (assuming that physical security countermeasures and monitoring are in place).

Consequences

What a successful CAPEC-625 attack can achieve.

Read Data

Affects: Confidentiality, Access Control

Extract long-term secret keys (e.g. keys used for VPN or WiFi authentication and encryption) to enable decryption of intercepted VOIP traffic.

How to mitigate it

Defenses that reduce the risk of CAPEC-625.

Strong physical security of all devices that contain secret key information. (even when devices are not in use)
Frequent changes to secret keys and certificates.

Frequently asked questions

Common questions about CAPEC-625.

What is CAPEC-625?: Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.
How do you prevent CAPEC-625?: Strong physical security of all devices that contain secret key information. (even when devices are not in use)
What weaknesses does CAPEC-625 target?: CAPEC-625 exploits 8 CWE weaknesses, including CWE-1247 (Improper Protection Against Voltage and Clock Glitches), CWE-1248 (Semiconductor Defects in Hardware Logic with Security-Sensitive Implications), CWE-1256 (Improper Restriction of Software Interfaces to Hardware Features), CWE-1319 (Improper Protection against Electromagnetic Fault Injection (EM-FI)).

References

Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.

Defend against CAPEC-625

Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.

Start free See pricing