How does the CWE Top 25 relate to secure coding requirements for medical device software?

FDA's premarket cybersecurity guidance cites the CWE Top 25 Most Dangerous Software Weaknesses as a reference point for evaluating the rigor of a manufacturer's secure coding practices, and IEC 81001-5-1 expects manufacturers to identify and mitigate known weakness classes during development. In practice, static application security testing (SAST) tools report findings normalized to CWE identifiers, which lets manufacturers demonstrate systematically that their secure development lifecycle addresses recognized weakness categories, not just tool-specific findings.

If our SAST tool reports zero CWE Top 25 findings, are we secure?

No, the CWE Top 25 is a ranked subset based on prevalence and severity in recently published CVEs, not an exhaustive list, and several weakness classes highly relevant to medical devices, such as CWE-798 (hard-coded credentials) and CWE-1188 (insecure default initialization), can fall outside the current Top 25 in a given year. A mature secure development program tracks the full CWE catalog relevant to its technology stack and updates its static analysis rule sets as the Top 25 list is revised annually.

Should CWE identifiers appear in a device's threat model?

Yes, referencing CWE identifiers as the credible defect classes underlying STRIDE or other threat categories gives reviewers a concrete, standardized way to see that identified threats correspond to known, exploitable weakness types rather than abstract risk statements, and it creates traceability between the threat model, code review findings, and static analysis results.

All terms

CybersecurityConnected & Cyber-Physical Devices Software LifecycleCWE

Common Weakness Enumeration

Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

Common Weakness Enumeration (CWE) is a category system for software and hardware weaknesses maintained by MITRE on behalf of CISA. While a CVE identifies a specific vulnerability in a specific product, a CWE identifies the underlying weakness type, for example, CWE-79 (Cross-Site Scripting), CWE-89 (SQL Injection), CWE-787 (Out-of-bounds Write), CWE-798 (Use of Hard-coded Credentials). The annual CWE Top 25 Most Dangerous Software Weaknesses ranks the most consequential weakness classes based on prevalence and severity in published CVEs.

What the regulation says

FDA's Premarket Cybersecurity guidance cites the CWE Top 25 as a reference for secure-coding rigor. IEC 81001-5-1 §5.3 expects manufacturers to identify and mitigate known weakness classes, with CWE as the typical evidence source.

What this means in practice

For medical device manufacturers, CWE is the link between secure-coding practices and the post-market vulnerability stream. Static analysis tools (SAST) report findings as CWEs; secure-coding training is structured around CWEs; threat models reference CWEs as the credible defect classes underlying STRIDE threats. Mapping your secure development controls to the CWE Top 25 is one of the cleanest ways to demonstrate IEC 81001-5-1 §5 conformance.

Examples

A developer accidentally hard-codes a default password into a device's firmware, which is an instance of CWE-798 (Use of Hard-coded Credentials).
During a security audit, a static analysis tool flags several instances of uncontrolled format string vulnerabilities, identifying them as CWE-134.
A team designing a new patient monitoring system reviews the CWE Top 25 to prioritize training on preventing common software weaknesses like CWE-79 (Cross-Site Scripting) in their web interface.

Common pitfalls

•Reporting SAST findings as raw tool output without normalizing to CWE, reviewers can't compare evidence across tools without it.
•Treating CWE Top 25 as exhaustive; many medical-device-relevant weaknesses (CWE-798 hardcoded credentials, CWE-1188 insecure default initialization) live outside the Top 25.
•Conflating CWE with CVE, CWE is the class of defect, CVE is one occurrence of it in a specific product.

Frequently asked questions

A CVE (Common Vulnerabilities and Exposures) identifies one specific, publicly disclosed vulnerability in a specific product version, while a CWE (Common Weakness Enumeration) identifies the underlying category of defect that made that vulnerability possible, such as CWE-79 for cross-site scripting or CWE-798 for hard-coded credentials. Every CVE is typically tagged with one or more CWE identifiers so that vulnerability databases and static analysis tools can be compared and aggregated across products by weakness type rather than treated as isolated incidents.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

CISA Known Exploited Vulnerabilities Catalog(KEV)

CISA's authoritative list of CVEs with confirmed in-the-wild exploitation, with mandatory federal remediation deadlines.

Cybersecurity

Common Vulnerabilities and Exposures(CVE)

A globally unique identifier for a publicly disclosed cybersecurity vulnerability.

Cybersecurity

Common Vulnerability Scoring System(CVSS)

An industry-standard 0–10 score that quantifies the severity of a software vulnerability.

Cybersecurity

Hardcoded Credentials

Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device.

More in Cybersecurity

· Same category

Cybersecurity

IEC 81001-5-1

International standard defining secure-product-lifecycle activities for health software, including medical devices.

Cybersecurity

OWASP IoT and Embedded Application Security

OWASP project resources for securing IoT, embedded, and connected medical devices.

Cybersecurity

SAST and DAST

Automated security testing - SAST analyzes source code at rest, DAST exercises a running application.

Cybersecurity

Secure Product Development Framework(SPDF)

A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 3

Link health: 3 verified· last checked 2026-06-20

MITRE·2MDCG·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Acronym: CWE
Sources: 3
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs.

·For medical device manufacturers, CWE is the link between secure-coding practices and the post-market vulnerability stream.
·Static analysis tools (SAST) report findings as CWEs; secure-coding training is structured around CWEs; threat models reference CWEs as the credible defect classes underlying STRIDE threats.
·Mapping your secure development controls to the CWE Top 25 is one of the cleanest ways to demonstrate IEC 81001-5-1 §5 conformance.

Remember this

Watch out: Reporting SAST findings as raw tool output without normalizing to CWE, reviewers can't compare evidence across tools without it.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.