Weakness (CWE)
CWE-334: Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
How to prevent it (1 mitigation)
-
Architecture and Design, Requirements
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Source: MITRE CWE-334
16 results · Feed
-
High 7.4
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK wit…
-
Critical 9.0CVE-2026-71851 Public exploit
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), in…
-
Medium 5.3
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All v…
-
Critical 9.1
Low token entropy in MegaBIP
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords…
-
Medium 5.3
Avahi: avahi wide-area dns predictable transaction ids
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
-
Medium —
Sharks has a Bias of Polynomial Coefficients in Secret Sharing
Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range `[0, 255]` they were instead in the range `[1, 255]`. A description from Cure53, who originally found the …
-
Medium 4.8
Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.
-
Critical 9.8
Journyx Unauthenticated Password Reset Bruteforce
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
-
Medium 6.6
A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remo…
-
High 8.8
Intentionally weakened effective strength in TETRA TEA1
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
-
Critical 9.8
MXsecurity Authentication Bypass
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
-
Medium 5.3
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow a…
-
Unscored —
Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.
-
High 7.5
Communication Components in multiple CODESYS products vulnerable to communication channel disruption
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.
-
High 7.7
An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binar…
-
High 7.1
A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could …