--- title: "CWE, Common Weakness Enumeration | MedTech Terms" description: "Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs. Plain-English Cybersecurity definition for MedTech te" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cwe#term", "name": "Common Weakness Enumeration", "alternateName": "CWE", "description": "Common Weakness Enumeration (CWE) is a category system for software and hardware weaknesses maintained by MITRE on behalf of CISA. While a CVE identifies a specific vulnerability in a specific product, a CWE identifies the underlying weakness type, for example, CWE-79 (Cross-Site Scripting), CWE-89 (SQL Injection), CWE-787 (Out-of-bounds Write), CWE-798 (Use of Hard-coded Credentials). The annual CWE Top 25 Most Dangerous Software Weaknesses ranks the most consequential weakness classes based on prevalence and severity in published CVEs.", "url": "https://medtechterms.com/terms/cwe", "termCode": "cwe", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/cwe#article", "headline": "CWE, Common Weakness Enumeration", "description": "Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs.", "url": "https://medtechterms.com/terms/cwe", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/cwe" }, "about": { "@id": "https://medtechterms.com/terms/cwe#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Common Weakness Enumeration, CWE, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-06-20", "dateModified": "2026-06-20", "citation": [ { "@type": "CreativeWork", "name": "Common Weakness Enumeration", "url": "https://cwe.mitre.org/", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "CWE Top 25 Most Dangerous Software Weaknesses", "url": "https://cwe.mitre.org/top25/", "publisher": { "@type": "Organization", "name": "MITRE" } }, { "@type": "CreativeWork", "name": "MDCG Cybersecurity Guidance", "url": "https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en", "publisher": { "@type": "Organization", "name": "MDCG" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "url": "https://medtechterms.com/terms/cvss" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/kev#term", "name": "CISA Known Exploited Vulnerabilities Catalog", "alternateName": "KEV", "url": "https://medtechterms.com/terms/kev" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sast-dast#term", "name": "SAST and DAST", "url": "https://medtechterms.com/terms/sast-dast" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/owasp-iot#term", "name": "OWASP IoT and Embedded Application Security", "url": "https://medtechterms.com/terms/owasp-iot" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hardcoded-credentials#term", "name": "Hardcoded Credentials", "url": "https://medtechterms.com/terms/hardcoded-credentials" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Common Weakness Enumeration", "item": "https://medtechterms.com/terms/cwe" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Common Weakness Enumeration [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle)CWE # Common Weakness Enumeration Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed June 20, 2026 ## Definition Common Weakness Enumeration (CWE) is a category system for software and hardware weaknesses maintained by MITRE on behalf of CISA. While a [CVE](/terms/cve) identifies a specific vulnerability in a specific product, a CWE identifies the underlying weakness type, for example, CWE-79 (Cross-Site Scripting), CWE-89 (SQL Injection), CWE-787 (Out-of-bounds Write), CWE-798 (Use of Hard-coded Credentials). The annual CWE Top 25 Most Dangerous Software Weaknesses ranks the most consequential weakness classes based on prevalence and severity in published CVEs. What the regulation says FDA's Premarket Cybersecurity guidance cites the CWE Top 25 as a reference for secure-coding rigor. [IEC 81001-5-1](/terms/iec-81001-5-1) §5.3 expects manufacturers to identify and mitigate known weakness classes, with CWE as the typical evidence source. ## What this means in practice For medical device manufacturers, CWE is the link between secure-coding practices and the post-market vulnerability stream. Static analysis tools (SAST) report findings as CWEs; secure-coding training is structured around CWEs; threat models reference CWEs as the credible defect classes underlying [STRIDE](/terms/stride) threats. Mapping your secure development controls to the CWE Top 25 is one of the cleanest ways to demonstrate [IEC 81001-5-1](/terms/iec-81001-5-1) §5 conformance. Common pitfalls - • Reporting SAST findings as raw tool output without normalizing to CWE, reviewers can't compare evidence across tools without it. - • Treating CWE Top 25 as exhaustive; many medical-device-relevant weaknesses (CWE-798 hardcoded credentials, CWE-1188 insecure default initialization) live outside the Top 25. - • Conflating CWE with CVE, CWE is the class of defect, CVE is one occurrence of it in a specific product. ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity CISA Known Exploited Vulnerabilities Catalog(KEV) CISA's authoritative list of CVEs with confirmed in-the-wild exploitation, with mandatory federal remediation deadlines. ](/terms/kev)[ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss)[ Cybersecurity Hardcoded Credentials Secrets - passwords, API keys, certificates - embedded in firmware or source code shipped on every device. ](/terms/hardcoded-credentials) ### More in Cybersecurity · Same category [ Cybersecurity IEC 81001-5-1 International standard defining secure-product-lifecycle activities for health software, including medical devices. ](/terms/iec-81001-5-1)[ Cybersecurity OWASP IoT and Embedded Application Security OWASP project resources for securing IoT, embedded, and connected medical devices. ](/terms/owasp-iot)[ Cybersecurity SAST and DAST Automated security testing - SAST analyzes source code at rest, DAST exercises a running application. ](/terms/sast-dast)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 MITRE· 2 MDCG· 1 1. [1 Common Weakness Enumeration Verified MITRE · cwe.mitre.org ](https://cwe.mitre.org/) 2. [2 CWE Top 25 Most Dangerous Software Weaknesses Verified MITRE · cwe.mitre.org ](https://cwe.mitre.org/top25/) 3. [3 MDCG Cybersecurity Guidance Verified MDCG · health.ec.europa.eu ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym CWE Sources 3 Updated 6/20/2026 [Compare with another term](/compare?a=cwe) Learn in 60 seconds Card Lesson Quiz Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs. - · For medical device manufacturers, CWE is the link between secure-coding practices and the post-market vulnerability stream. - · Static analysis tools (SAST) report findings as CWEs; secure-coding training is structured around CWEs; threat models reference CWEs as the credible defect classes underlying STRIDE threats. - · Mapping your secure development controls to the CWE Top 25 is one of the cleanest ways to demonstrate IEC 81001-5-1 §5 conformance. Remember this Watch out: Reporting SAST findings as raw tool output without normalizing to CWE, reviewers can't compare evidence across tools without it. Related terms - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [SAST and DAST ](/terms/sast-dast) - [OWASP IoT and Embedded Application Security ](/terms/owasp-iot) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Hardcoded Credentials ](/terms/hardcoded-credentials) You may also need Auto-suggested from Cybersecurity and shared keywords. - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [Healthcare and Public Health Cybersecurity Performance Goals(HPH-CPG) ](/terms/hph-cpg) - [ICS Medical Advisory(ICSMA) ](/terms/ics-medical-advisory) - [Brainjacking ](/terms/brainjacking) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)