Business EUVD-2025-209143

Despite the absence of a CVSS score, this vulnerability carries extreme real-world risk. The attack vector is local or network-based depending on deployment, requires no authentication, and directly undermines the confidentiality of encrypted credit card data-the core security function of the library. Unlike high-CVSS-but-low-impact issues, this represents authentic, material risk: any encrypted transaction using a derived key is potentially recoverable through key space exhaustion or statistical analysis. The predictability of rand() combined with MD5's known collision properties means an attacker with access to encrypted payloads can systematically recover keys. The vulnerability affects financial transaction processing, triggering regulatory obligations (PCI DSS, etc.). Absence of KEV status does not diminish severity; this is a foundational cryptographic failure in a payment security library.

An attacker who gains access to encrypted credit card data stored by a vulnerable Business::OnlinePayment::StoredTransaction installation can exploit the weak key generation. Since the secret key is derived from MD5(rand()), the attacker can enumerate the limited key space by replaying known rand() sequences or using statistical properties of Perl's PRNG to narrow possibilities. With computational resources, the attacker recovers encryption keys and decrypts stored transaction records, compromising card numbers, expiration dates, and other sensitive payment data without requiring authentication or network access to the generating system.