Skip to content
OpenAdvisories

Weakness (CWE)

CWE-341: Predictable from Observable State

Base Draft

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

How to prevent it (3 mitigations)

  1. Implementation

    Increase the entropy used to seed a PRNG.

  2. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

  3. Implementation

    Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-341

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-87913

    Missing S3 bucket ownership verification in the AWS Security Agent MCP server

    A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that arc…

    AWS AWS Security Agent MCP server
  • Medium 5.9
    CVE-2026-87912

    Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

    A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure stat…

    AWS AWS Security Agent plugin
  • Medium 4.3
    CVE-2025-42925

    Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

    Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identif…

    SAP_SE SAP NetWeaver AS Java (IIOP Service)
  • Medium 5.0
    CVE-2025-48461 Public exploit

    Weak Session Cookie Entropy

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset p…

    Advantech Advantech Wireless Sensing and Equipment (WISE)
  • Medium 5.3
    CVE-2020-5365

    Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, r…

    Dell Isilon OneFS