CWE-332 Insufficient Entropy in PRNG
variantThe lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (14)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-18486US | high7.2 | Exploit | ||
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided… | ||||
| CVE-2018-9057US | critical9.8 | — | ||
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which make… | ||||
| CVE-2016-15005US | high8.8 | — | ||
CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with… | ||||
| CVE-2019-1715US | high7.5 | — | ||
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and C… | ||||
| CVE-2016-10743US | high7.5 | — | ||
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call. | ||||
| CVE-2016-9154US | high7.5 | — | ||
Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and… | ||||
| CVE-2016-1902US | high7.5 | — | ||
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP… | ||||
| CVE-2023-20107US | high7.5 | — | ||
A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco… | ||||
| CVE-2014-9690US | high7.5 | — | ||
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the ran… | ||||
| CVE-2017-9371US | medium5.9 | — | ||
In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an… | ||||
| CVE-2025-21767US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
The following bug repor… | ||||
| CVE-2014-0016US | medium4.3 | — | ||
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the s… | ||||
| CVE-2013-1445US | medium4.3 | — | ||
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which ma… | ||||
| CVE-2026-3290US | — | — | ||
Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan