Skip to content
OpenAdvisories

Weakness (CWE)

CWE-343: Predictable Value Range from Previous Values

Base Draft

The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.

How to prevent it (4 mitigations)

  1. Architecture and Design, Implementation

    The output of a random number generator
    should not be predictable based on observations of
    previous values.

  2. Implementation

    Increase the entropy used to seed a PRNG.

  3. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

  4. Implementation

    Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Source: MITRE CWE-343

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Low 2.1
    CVE-2026-33221

    Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

    Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload …

    nhost nhost github.com/nhost/nhost Go
  • Medium 6.6
    CVE-2026-32694

    Insecure Direct Object Reference attack via predictable secret ID in Juju

    In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets t…

    Canonical Juju github.com/juju/juju Go
  • Unscored —
    CVE-2017-7901

    A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 110…

  • Medium 6.5
    CVE-2017-6030

    Schneider Electric Modicon PLCs Predictable Value Range from Previous Values

    A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions pri…

    Schneider Electric Modicon M221 Modicon M241 Modicon M251 ICS / OT
  • Medium 6.4
    CVE-2014-5409

    GE Hydran M2 Predictable Value Range from Previous Values

    The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these val…

    GE Hydran M2, containing the 17046 Ethernet option