What is the CVSS score of CVE-2025-50122?

CVE-2025-50122 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-50122?

Within 24 hours: Inventory all affected systems and restrict access to installation/upgrade artifacts; immediately disable the affected product if business-critical systems depend on it. Within 7 days: Implement mandatory root password changes across all affected systems using a cryptographically secure method independent of the vulnerable algorithm; enable enhanced logging and monitoring for administrative access attempts. Within 30 days: Identify and deploy alternative solutions or vendor patches when available; conduct forensic analysis to detect unauthorized root access.

CVE-2025-50122

EUVD-2025-21127 HIGH

Insufficient Entropy (CWE-331)

2025-07-11 cybersecurity@se.com

Privilege Escalation Information Disclosure

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21127

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

CVE Published

Jul 11, 2025 - 10:15 nvd

HIGH 8.9

DescriptionCVE.org

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts.

AnalysisAI

CVE-2025-50122 is a cryptographic entropy vulnerability (CWE-331) in password generation algorithms that allows attackers with access to installation or upgrade artifacts to reverse engineer and discover root passwords. This affects products using insufficient entropy in their root password generation during deployment phases. With a CVSS score of 8.9 and network-adjacent attack vector, this poses a critical risk to systems deployed in environments where installation artifacts may be accessible or retained. The vulnerability requires moderate attack complexity but no user interaction, making it viable for targeted attacks against infrastructure during or shortly after deployment.

Technical ContextAI

CWE-331 (Insufficient Entropy) describes a cryptographic weakness where random number generation uses inadequate entropy sources for security-critical operations. In this case, root password generation during installation/upgrade procedures relies on predictable or insufficiently random seed values. Attackers can reconstruct the Random Number Generator (RNG) state by analyzing installation artifacts (logs, configuration files, system state snapshots) and deterministically reproduce the exact password generation sequence. This attack is feasible because: (1) installation/upgrade artifacts often contain metadata enabling RNG state inference, (2) the password generation algorithm itself may be deterministic once the seed is known, and (3) root password entropy is finite and may be brute-forced if the RNG output space is limited. The vulnerability exists at the intersection of cryptography (weak RNG), system administration (artifact retention), and software lifecycle management (deployment procedures).

RemediationAI

Mitigation steps (in priority order): (1) Obtain and apply the vendor patch that increases RNG entropy (use cryptographically strong sources: /dev/urandom on Linux, CryptGenRandom on Windows, or FIPS-approved libraries). (2) For unpatched systems: regenerate root passwords immediately post-deployment using a secure offline password manager; delete or encrypt installation/upgrade artifacts to prevent RNG state reconstruction. (3) Implement installation artifact lifecycle controls: segregate installation media from production networks, encrypt artifact storage, maintain detailed audit logs of artifact access. (4) Rotate root credentials on all affected systems deployed in the past [X] months (vendor-dependent). (5) If in-place upgrade is vulnerable, perform only offline/air-gapped upgrades or delay until patch available. Vendor patch version and availability window should be obtained from the CVE's official advisory or CISA KEV catalog. Test patches in non-production first given the bootstrap nature of root password security.