What CVEs are caused by CWE-1301?

2 recorded CVEs are attributed to CWE-1301, including CVE-2025-12216, CVE-2025-29946.

What are the consequences of CWE-1301?

Exploiting CWE-1301 can lead to: Read Memory, Read Application Data.

Is CWE-1301 actively exploited?

2 recorded CVEs are caused by CWE-1301; none are currently in CISA's KEV catalog of actively exploited flaws.

Base weakness

Incomplete

CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component

The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.

Last updated May 1, 2026

Recorded CVEs

With this primary weakness

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

Physical properties of hardware devices, such as remanence of magnetic media, residual charge of ROMs/RAMs, or screen burn-in may still retain sensitive data after a data removal process has taken place and power is removed. Recovering data after erasure or overwriting is possible due to a phenomenon called data remanence. For example, if the same value is written repeatedly to a memory location, the corresponding memory cells can become physically altered to a degree such that even after the original data is erased that data can still be recovered through physical characterization of the memory cells.

Real-world CVEs

2 recorded CVEs are caused by CWE-1301 (Insufficient or Incomplete Data Removal within Hardware Component). The highest-severity and most recent are shown first. 1 new CWE-1301 CVE has been recorded so far in 2026 (1 in 2025).

Common consequences

What can happen when CWE-1301 is exploited.

Read Memory, Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-1301, grouped by where in the lifecycle they apply.

Architecture and Design

Apply blinding or masking techniques to implementations of cryptographic algorithms.

Implementation

Alter the method of erasure, add protection of media, or destroy the media to protect the data.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2019-8575 — Firmware Data Deletion Vulnerability in which a base station factory reset might not delete all user information. The impact of this enables a new owner of a used device that has been "factory-default reset" with a vulnerable firmware version can still retrieve, at least, the previous owner's wireless network name, and the previous owner's wireless security (such as WPA2) key. This issue was addressed with improved, data deletion.

Attack patterns

CAPEC attack patterns that exploit this weakness.

CAPEC-37: Retrieve Embedded Sensitive Data

Frequently asked questions

Common questions about CWE-1301.

What is CWE-1301?: The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
What CVEs are caused by CWE-1301?: 2 recorded CVEs are attributed to CWE-1301, including CVE-2025-12216, CVE-2025-29946.
How do you prevent CWE-1301?: Apply blinding or masking techniques to implementations of cryptographic algorithms.
What are the consequences of CWE-1301?: Exploiting CWE-1301 can lead to: Read Memory, Read Application Data.
Is CWE-1301 actively exploited?: 2 recorded CVEs are caused by CWE-1301; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-1301

Get alerted the moment a new CWE-1301 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing