Mapping the Smart Home Threat Taxonomy to STRIDE, CAPEC and CWE

TL;DR

• All 179 entries in the Smart Home Threat Taxonomy carry STRIDE. The 169 threats also map to CAPEC 3.9 and CWE 5.0 where a fit exists; the 10 structural hazards map to STRIDE only.
• Elevation of Privilege is the most common STRIDE category (65 threats) and Repudiation the rarest (7).
• 133 threats map to at least one CWE, but only 60 map to a CAPEC pattern. The most common weakness is CWE-359, exposure of private personal information, on 17 threats.
• 27 threats map to neither. That isn’t a gap in the work; it’s a finding. Many smart home threats are design consequences, not attack patterns or code weaknesses.
• Every CWE and CAPEC ID was checked against MITRE’s own pages. The check changed the mappings on 26 entries and removed every CWE that MITRE marks Discouraged or Prohibited for mapping.

In Every Connected Home Fails Open Somewhere I introduced the Smart Home Threat Taxonomy, the reference for my card game Open House. Every entry is mapped to three frameworks that most security teams already use:

• STRIDE, Microsoft’s six threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.
• CAPEC, MITRE’s Common Attack Pattern Enumeration and Classification, version 3.9: how attacks are carried out.
• CWE, MITRE’s Common Weakness Enumeration, version 5.0: the weaknesses in software and hardware that attacks exploit.

The mappings let you take a finding from a game of Open House and drop it into the tooling and reports you already have. They also tell you something about the smart home, and that’s what this post is about. All the figures below are computed from the taxonomy’s data file.

STRIDE: elevation first, repudiation last

Each of the 169 threats carries one to three STRIDE letters: 105 carry one, 62 carry two and 2 carry three. Here is how they fall across the thirteen suits.

Across all 169 threats the totals are:

• Elevation of privilege: 65
• Information disclosure: 51
• Tampering: 47
• Denial of service: 33
• Spoofing: 32
• Repudiation: 7

At first glance, elevation of privilege coming out on top looks like a quirk. It isn’t. In a house, elevation is how a guest becomes an admin, how a plug on the guest network reaches the alarm, and how a cloud bug lets one customer see another customer’s home. The Remote Control and Household suits lead on it, with 8 each.

Information disclosure is where you’d expect it: the Cameras and Doorbells suit has 11 of its 13 threats in that column. A camera is a window into a private space, and most of its flaws are about who can look through it.

Tampering peaks in Domotics (9) and Energy (7). That’s the physical-consequence story again: tampering with a setpoint or a schedule isn’t a data integrity problem when the setpoint is the temperature of the house.

Why repudiation is so rare

Only seven threats carry an R, and they’re telling. OPH-HB-2 Logs Without Names, OPH-AL-2 Shared Code, No Name and OPH-HH-Q One Account for Everyone are all the same problem: a house that can’t say who did what. In an office, repudiation is about audit trails and non-repudiation of transactions. In a home, it’s about whose code opened the front door at 3 a.m., and most products can’t tell you.

I don’t think seven is the true size of the problem. It’s low because smart home products rarely log people at all, so there’s very little to repudiate. If you build smart home products, I’d treat the R column as the one most likely to be under-counted in your own threat models.

The structural hazards

The ten structural hazards, the Trumps in the game, are mapped to STRIDE only: E on 6, D on 4, I on 3, S on 2, and T and R on one each. They don’t have CAPEC or CWE mappings, and they shouldn’t. A hazard like OPH-TR-6 Houses Change Hands isn’t an attack or a weakness; it’s a property of houses that makes other threats worse.

CAPEC and CWE coverage

Of the 169 threats:

• 51 map to both a CAPEC pattern and a CWE.
• 82 map to a CWE only.
• 9 map to a CAPEC pattern only.
• 27 map to neither.

So 133 threats (79%) have at least one CWE, but only 60 (36%) have a CAPEC pattern. Between them they use 74 distinct CWEs and 45 distinct CAPEC patterns.

CAPEC’s coverage is the thinner of the two because CAPEC describes how attacks are done, and many smart home threats don’t need an attack at all. A guest who was never removed from the household doesn’t use an attack pattern; they open the app.

No CAPEC pattern dominates. Five patterns tie at three threats each: Privilege Abuse (CAPEC-122), Flooding (CAPEC-125), Identity Spoofing (CAPEC-151), Malicious Software Update (CAPEC-186) and Fake the Source of Data (CAPEC-194).

The weaknesses that come up most

CWE-359, Exposure of Private Personal Information to an Unauthorized Actor, is on 17 threats, more than twice as many as any other CWE. Then come CWE-290 Authentication Bypass by Spoofing and CWE-1220 Insufficient Granularity of Access Control on 8 each, and CWE-308 Use of Single-factor Authentication on 6.

Put those together and you have a fair summary of the smart home’s weaknesses: the house leaks private life, devices believe whatever claims to be them, access control is all or nothing, and one password guards the lot. CWE-1220 in particular is the household problem in CWE form: the product has an owner and everyone else, and nothing in between.

The 27 threats with no CAPEC or CWE

This is the part of the mapping I find most interesting. 27 threats map to no CAPEC pattern and no CWE. Every suit has at least one, and the Household suit has the most, with 6. Here are some of them:

• OPH-HH-J Landlord Sees Inside
• OPH-HH-7 Emergency Access Denied
• OPH-HH-4 Alert Goes to the Absent Owner
• OPH-AP-Q Mower Starts with the Children Out †
• OPH-DM-5 Someone Else’s Thermostat
• OPH-CM-5 Camera Sees the Neighbours
• OPH-CL-6 One Region, Every Home
• OPH-LC-K Vendor Turns Off the Servers

Look at what these have in common. Nobody exploits a weakness. A landlord sees inside because the product lets the account owner see everything. A robot mower starts with the children on the lawn because the schedule doesn’t know who’s in the garden. During a Texas heat wave, a demand-response programme turned up the thermostats of the homes enrolled in it, and many of those households hadn’t realised what they’d signed up for (Dallas Morning News, June 2021). A vendor shuts down its servers and the hubs in people’s homes stop working (VentureBeat, Revolv).

These are design consequences. CAPEC catalogues how attackers attack, and CWE catalogues the flaws in code and hardware that they exploit. Neither was built to describe a product that works exactly as designed and still harms the people living with it. I could have forced a loose CWE onto each of them to make the coverage chart look better. I didn’t, because a mapping that doesn’t fit is worse than no mapping: it sends the reader to the wrong fix.

That’s why I’d say the 27 are a finding in their own right. If your threat modeling process is driven by a weakness catalogue, or by a scanner that reports CWEs, these threats will never show up in it. You’ll only find them by looking at the house and the people in it, which is exactly what Open House makes you do.

How the mappings were checked against MITRE

A mapping is only useful if the ID means what you think it means. So once the taxonomy was drafted, every CWE and CAPEC ID it used was checked against MITRE’s own page for that ID, on 2 November 2026.

1. Every ID was fetched. The draft used 79 CWE IDs and 48 CAPEC IDs. Each page was fetched and checked for its name, its status and, for CWEs, MITRE’s mapping guidance. None of the CAPEC patterns was deprecated, and no ID went unverified.
2. Every mapping was graded. Each of the 236 mapping tags in the draft was graded as a good fit, a loose fit or wrong: 179 were good, 52 loose and 5 wrong.
3. MITRE’s usage guidance was applied. CWE marks each weakness as Allowed, Allowed-with-Review, Discouraged or Prohibited for vulnerability mapping. Five CWEs in the draft were Discouraged (CWE-269, CWE-311, CWE-345, CWE-400 and CWE-668) and one was Prohibited (CWE-1068). All six are gone from v1.0, removed or replaced by a more specific weakness. Of the 74 CWEs in v1.0, 55 are Allowed and 19 are Allowed-with-Review.
4. The mappings were corrected. The check changed the mappings on 26 entries: 27 tags came out and 11 went in. Where a loose CAPEC added nothing that the CWE didn’t already say, I left the CAPEC empty rather than keep it for the sake of coverage.
5. Names follow CWE 5.0. CWE 5.0 renamed some entries. CWE-306 is now Missing Authentication for Critical Functionality, and several titles lost their bracketed nicknames: CWE-636 is now just Not Failing Securely, without Failing Open. The taxonomy uses the 5.0 names.

One honest limitation: 15 of the CWE pages were served from a cache titled 4.20 rather than 5.0. None of those IDs is deprecated, but if you’re relying on one of them for something formal, check it against the live page.

The 38 public cases cited in the taxonomy went through the same process, each checked against its source, and twelve were reworded to match what the source actually says.

Note to security teams

• Use the mappings to connect, not to define. A CWE tells you which class of fix to reach for. It doesn’t tell you the threat. Read the entry.
• Don’t let a weakness catalogue set your scope. If your process only looks for CWEs, you’ll miss the 27 threats here that have none, and they include some of the ones that hurt people the most.
• Count your R column. If your smart home threat model has almost no repudiation threats, ask whether that’s because there are none or because nobody logs who did what.

Final thoughts

Mapping is tedious work, and it’s easy to do badly: pick the nearest-sounding CWE, tick the box and move on. I’d rather have fewer mappings that are right than a full coverage chart that misleads. The 27 threats with no mapping are where the smart home is genuinely different from the systems these frameworks were built for, and that’s the bit worth paying attention to.

The full mappings for every entry are on the Smart Home Threat Taxonomy pages, and in the downloads on the overview page.

Stay tuned!

Related links

• Smart Home Threat Taxonomy
• Every Connected Home Fails Open Somewhere: A Threat Taxonomy for the Smart Home
• Open House: A Threat Modeling Card Game for the Connected Home
• Structural hazards
• CWE and CAPEC at MITRE