CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
variantA Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (22)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-26852US | critical9.8 | — | ||
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerab… | ||||
| CVE-2022-40267US | critical9.1 | — | ||
Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with s… | ||||
| CVE-2024-7558US | high8.0OT elevated | — | ||
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespa… | ||||
| CVE-2023-49343US | high7.8 | — | ||
Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible… | ||||
| CVE-2020-9291US | high7.8 | — | ||
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file nam… | ||||
| CVE-2026-25235US | high7.5 | — | ||
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens a… | ||||
| CVE-2020-28597US | high7.5 | — | ||
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password re… | ||||
| CVE-2025-62710US | medium5.9 | — | ||
Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using… | ||||
| CVE-2023-21366US | medium5.5OT elevated | — | ||
In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no… | ||||
| CVE-2016-15006US | medium5.3 | — | ||
A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the file main.c of the component Scrambling Ta… | ||||
| CVE-2024-22194US | low2.8 | — | ||
cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerabil… | ||||
| CVE-2026-18451US | — | — | ||
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take con… | ||||
| CVE-2026-55889US | —OT elevated | — | ||
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-dro… | ||||
| CVE-2026-73794US | — | — | ||
HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG) | ||||
| CVE-2026-19396US | — | — | ||
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the… | ||||
| CVE-2026-66372US | — | — | ||
The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space. | ||||
| CVE-2026-26018US | — | — | ||
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash t… | ||||
| CVE-2025-55069US | — | — | ||
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the… | ||||
| CVE-2025-20613US | — | — | ||
Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable information disclosure via loc… | ||||
| CVE-2025-7770US | — | — | ||
Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on the current timestam… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan