EUVD-2026-100949
GHSA-c882-58j8-223q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege access
-
DeliveryCollect emitted PRNG-derived values
-
ExploitRecover predictable seed/state
-
ExecutionPredict future security tokens
-
ImpactLimited information disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Unpredictable PRNG seeds
|
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on HPE NonStop MODULAR NSJ (PR:L) plus victim user interaction (UI:R), and succeeds only against the predictable PRNG seeding used by the platform's random number generation. The high attack complexity (AC:H) reflects the analysis needed to recover the seed/internal state and predict values, which limits realistic exploitation. The description does not identify a specific feature toggle or non-default configuration mode, so the condition is the inherent predictable-seed behavior of the PRNG rather than an optional setting; impact is bounded to Low confidentiality/integrity/availability. |
| Impact | This is a moderate-severity, low-priority issue in practice. The HPE-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, base 4.6) paints a consistently constrained picture: although network-reachable, exploitation requires high attack complexity (AC:H), an already-authenticated low-privileged account (PR:L), and victim user interaction (UI:R), with only Low impact across confidentiality, integrity, and availability. CWE-337 (predictable PRNG seed) means security-relevant random values (tokens, session identifiers, or key material) may be guessable, but the Low impact ratings indicate the vendor does not assess this as yielding full compromise. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of exploitation activity - the signals are internally consistent and all point to a real-but-low operational risk rather than a high-CVSS-but-overblown issue or an actively exploited threat. The chief uncertainty is scope: the description does not state WHICH random values are affected (e.g., cryptographic keys vs. non-security tokens), and affected versions are unspecified (CPE wildcard) - verify the exact impacted component and fixed version with HPE advisory hpesbns05148en_us. |
| Exploit ScenarioDerived | An authenticated low-privileged user of a Java application running on HPE NonStop MODULAR NSJ observes or collects random values the platform generates, then leverages the predictable PRNG seed to reconstruct the generator state and predict future values such as session tokens or identifiers. With victim user interaction and after non-trivial analysis (AC:H), the attacker predicts a security-relevant value to gain limited unauthorized access or disclose information. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Predictable pseudo-random number generation in HPE NonStop MODULAR NSJ weakens any security function that depends on unpredictable output, allowing an authenticated low-privileged attacker who can also induce victim interaction to recover the PRNG seed or internal state and forecast subsequent values. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L, 4.6) shows exploitation requires a valid low-privilege account plus user interaction, and the high attack complexity reflects the analysis needed to reconstruct the generator state; confidentiality, integrity and availability impacts are all bounded to Low. This is a moderate-severity, low-priority issue in practice, and no public exploit was identified at time of analysis - it has not been confirmed actively exploited (no CISA KEV listing) and no proof-of-concept code is referenced in the available intelligence.
RemediationAI
No fixed version is identified in the available intelligence, so patch status should be confirmed directly against the HPE Security Bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US and the corresponding NonStop release notes; apply the vendor-supplied corrected release as soon as HPE publishes it. Until then, treat the platform PRNG as non-cryptographic: wherever NonStop MODULAR NSJ supplies randomness for keys, tokens, nonces, or salts, source that entropy from an external validated DRBG or hardware entropy generator instead, accepting the added integration, latency and key-management overhead that substitution introduces. Because exploitation needs an authenticated low-privilege account (PR:L), tighten access so that only personnel who genuinely require NSJ access hold credentials, and audit for stale or over-privileged accounts; note this reduces but does not eliminate exposure. Because the vector requires victim interaction (UI:R), reinforce phishing and social-engineering awareness for NSJ operators, and restrict network reachability of NSJ management or PRNG-consuming services to trusted segments or jump hosts, accepting that such filtering can complicate legitimate remote administration. Monitor for anomalous session or token reuse patterns that would indicate successful prediction of generated values, recognizing that such detection is opportunistic rather than reliable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-337 (Predictable Seed in a Pseudo Random Number Generator) affecting HPE NonStop MODULAR NSJ. Rather than a memory-safety or injection defect, the root cause is entropy: the PRNG is seeded from a source that an observer can predict, infer, or reproduce, so the generator's output stream becomes derivable once the seed or internal state is recovered. Because the CPE identifier (cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_modular_nsj:*:*:*:*:*:*:*:*) uses a wildcard version, no specific release boundary is delineated in the supplied data; the vulnerable behavior is inherent to the platform's random number generation rather than gated behind an optional, non-default feature flag. Network reachability (AV:N) is indicated, but the practical barrier is the combination of network access, an authenticated low-privilege foothold (PR:L), victim user interaction (UI:R), and the analytical effort to reconstruct state (AC:H). Downstream consumers of this randomness - session identifiers, tokens, nonces, salts, or cryptographic key material - inherit the weakness, which is why confidentiality and integrity impacts are assessed as Low rather than None.
Know when Hpe Nonstop Modular Nsj gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Network-reachable Java service but predicting PRNG output demands effort (AC:H), needs a low-privileged authenticated user (PR:L) and interaction (UI:R), yielding only limited impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB