Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-337 (PRNG中使用可预测种子) — Vulnerability Class 11

11 vulnerabilities classified as CWE-337 (PRNG中使用可预测种子). AI Chinese analysis included.

CWE-337 represents a critical cryptographic weakness where a pseudo-random number generator is initialized using a predictable seed, such as the system time or process identifier. This flaw fundamentally undermines security because it drastically reduces the entropy required to predict future outputs. Attackers typically exploit this vulnerability by reverse-engineering the seed source, allowing them to reproduce the exact sequence of random numbers generated by the application. This capability enables unauthorized access to session tokens, encryption keys, or other sensitive data that relies on the PRNG for secrecy. To mitigate this risk, developers must avoid deterministic inputs and instead utilize cryptographically secure random number generators that draw entropy from the operating system’s hardware sources. Ensuring high unpredictability in seed generation is essential for maintaining the integrity of security mechanisms dependent on randomness.

MITRE CWE Description
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time. The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.
Common Consequences (1)
OtherVaries by Context
Mitigations (3)
Use non-predictable inputs for seed generation.
Architecture and Design, RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.
ImplementationUse a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
Examples (1)
Both of these examples use a statistical PRNG seeded with the current value of the system clock to generate a random number:
Random random = new Random(System.currentTimeMillis()); int accountID = random.nextInt();
Bad · Java
srand(time()); int randNum = rand();
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2026-26018 CoreDNS Loop Detection Denial of Service Vulnerability — coredns 7.5 High2026-03-06
CVE-2026-25235 PEAR Has a Predictable Verification Hash in Election Account Requests — pearweb 9.1AICriticalAI2026-02-03
CVE-2025-62710 Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl — sakai 5.9 Medium2025-10-22
CVE-2025-55069 AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator — CLICK PLUS C0-0x CPU firmware 8.3 High2025-09-23
CVE-2025-7770 Predictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect Advanced — Cloud Connect Advanced 9.1AICriticalAI2025-08-06
CVE-2024-7558 Juju 安全漏洞 — Juju 8.7 High2024-10-02
CVE-2023-49343 Ubuntu Budgie Extras 安全漏洞 — Budgie Extras 6.0 Medium2023-12-14
CVE-2022-40267 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series — MELSEC iQ-F Series FX5U-32MT/ES 5.9 Medium2023-01-20
CVE-2016-15006 enigmaX Scrambling Table main.c getSeed prng seed — enigmaX 3.7 Low2023-01-02
CVE-2022-26852 Dell Technologies Dell PowerScale OneFS安全漏洞 — PowerScale OneFS 8.1 High2022-04-08
CVE-2020-28597 Epignosis EfrontPro 安全漏洞 — Epignosis 9.1 -2021-03-03

Vulnerabilities classified as CWE-337 (PRNG中使用可预测种子) represent 11 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.