Contents of non-volatile memory chips or non-fixed storage (e.g., SD cards, Compact Flash, hard disks, USB sticks) can be directly read out for examination or modification by a chip reader. In some cases this may be possible without removing the chip from the circuit board, but most often this will involve physically desoldering the chip and non-destructively removing it from the device. By reading information from ROM or NVRAM, a threat actor would be able to extract any secrets stored on it. If the extracted storage contents contain unencrypted firmware (even partial), this can ease reverse engineering by an adversary to identify other potential vulnerabilities or security-relevant data (e.g., passwords, cryptographic keys).

• CWE-311: Missing Encryption of Sensitive Data
• CWE-312: Cleartext Storage of Sensitive Information
• CWE-1282: Assumed-Immutable Data is Stored in Writable Memory