Monthly
Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending specially crafted DNS queries (CVSS 7.5).
Pearweb versions up to 1.33.0 contains a vulnerability that allows attackers to guess verification tokens and potentially verify election account requests witho (CVSS 7.5).
Predictable pseudo-random number generation in HPE NonStop MODULAR NSJ weakens any security function that depends on unpredictable output, allowing an authenticated low-privileged attacker who can also induce victim interaction to recover the PRNG seed or internal state and forecast subsequent values. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, 4.6) shows exploitation requires a valid low-privilege account plus user interaction, and the high attack complexity reflects the analysis needed to reconstruct the generator state; confidentiality, integrity and availability impacts are all bounded to Low. This is a moderate-severity, low-priority issue in practice, and no public exploit was identified at time of analysis - it has not been confirmed actively exploited (no CISA KEV listing) and no proof-of-concept code is referenced in the available intelligence.
Sakai LMS versions prior to 23.5 and 25.0 generate the server-side AES encryption key (serverSecretKey) for EncryptionUtilityServiceImpl using Apache Commons RandomStringUtils backed by the non-cryptographic java.util.Random PRNG, so the key can be reconstructed by an attacker who holds ciphertext and can approximate the PRNG seed from predictable server state such as the start-time window; successful key recovery allows decryption of at-rest or exported strings protected by the service. The flaw is reachable by unauthenticated remote attackers per the CVSS vector (AV:N/AC:H/PR:N/UI:N), but the high attack complexity reflects two real prerequisites - prior possession of ciphertext produced by the service and successful seed estimation - rather than simple network reachability. EPSS is 0.20% (9th percentile), no public exploit code and no CISA KEV entry were identified at time of analysis, making this a genuine but comparatively low-urgency cryptographic weakness; vendor patches are available in Sakai 23.5, 25.0, and trunk (SAK-49866).
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable information disclosure via local access. Rated low severity (CVSS 2.0), this vulnerability is low attack complexity. No vendor patch available.
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JUJU_CONTEXT_ID is a predictable authentication secret. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
Coredns versions up to 1.14.2 contains a vulnerability that allows attackers to crash the DNS server by sending specially crafted DNS queries (CVSS 7.5).
Pearweb versions up to 1.33.0 contains a vulnerability that allows attackers to guess verification tokens and potentially verify election account requests witho (CVSS 7.5).
Predictable pseudo-random number generation in HPE NonStop MODULAR NSJ weakens any security function that depends on unpredictable output, allowing an authenticated low-privileged attacker who can also induce victim interaction to recover the PRNG seed or internal state and forecast subsequent values. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, 4.6) shows exploitation requires a valid low-privilege account plus user interaction, and the high attack complexity reflects the analysis needed to reconstruct the generator state; confidentiality, integrity and availability impacts are all bounded to Low. This is a moderate-severity, low-priority issue in practice, and no public exploit was identified at time of analysis - it has not been confirmed actively exploited (no CISA KEV listing) and no proof-of-concept code is referenced in the available intelligence.
Sakai LMS versions prior to 23.5 and 25.0 generate the server-side AES encryption key (serverSecretKey) for EncryptionUtilityServiceImpl using Apache Commons RandomStringUtils backed by the non-cryptographic java.util.Random PRNG, so the key can be reconstructed by an attacker who holds ciphertext and can approximate the PRNG seed from predictable server state such as the start-time window; successful key recovery allows decryption of at-rest or exported strings protected by the service. The flaw is reachable by unauthenticated remote attackers per the CVSS vector (AV:N/AC:H/PR:N/UI:N), but the high attack complexity reflects two real prerequisites - prior possession of ciphertext produced by the service and successful seed estimation - rather than simple network reachability. EPSS is 0.20% (9th percentile), no public exploit code and no CISA KEV entry were identified at time of analysis, making this a genuine but comparatively low-urgency cryptographic weakness; vendor patches are available in Sakai 23.5, 25.0, and trunk (SAK-49866).
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable information disclosure via local access. Rated low severity (CVSS 2.0), this vulnerability is low attack complexity. No vendor patch available.
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JUJU_CONTEXT_ID is a predictable authentication secret. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.