Common Weakness Enumeration
CWE-330
DiscouragedUse of Insufficiently Random Values
Abstraction: Class · Status: Stable
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
491 vulnerabilities reference this CWE, most recent first.
CVE-2026-102719 (GCVE-0-2026-102719)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:45 – Updated: 2026-09-29 18:39
VLAI
EPSS
VEX
Summary
Predictable DTLS HelloVerifyRequest Cookie in NetX Secure
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 18:39 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | netxduo |
Affected:
0 , ≤ 6.5.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102719",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T18:39:04.305372Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T18:39:25.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "netxduo",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "afldl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePredictable DTLS HelloVerifyRequest Cookie in NetX Secure\u003c/p\u003e"
}
],
"value": "Predictable DTLS HelloVerifyRequest Cookie in NetX Secure"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:45:21.609Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-j6gx-3j6v-3hm4"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-102719",
"datePublished": "2026-09-29T17:45:21.609Z",
"dateReserved": "2026-09-29T16:15:15.514Z",
"dateUpdated": "2026-09-29T18:39:25.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96599 (GCVE-0-2026-96599)
Vulnerability from cvelistv5 – Published: 2026-09-23 14:52 – Updated: 2026-09-24 14:23
VLAI
EPSS
VEX
Title
Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
Summary
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:19 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/isotope/core/issues/2585 | issue-tracking |
| https://github.com/isotope/core | product |
| https://github.com/isotope/core/blob/028d47cbe69c… | technical-description |
| https://github.com/isotope/core/blob/028d47cbe69c… | technical-description |
| https://www.vulncheck.com/advisories/isotope-ecom… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| isotope | isotope-core |
Affected:
0 , ≤ 2.9.10
(semver)
|
Date Public
2026-09-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:19:36.657196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:19:52.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/isotope/core/issues/2585"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/isotope/isotope-core",
"product": "isotope-core",
"vendor": "isotope",
"versions": [
{
"lessThanOrEqual": "2.9.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:23:24.802Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2585",
"tags": [
"issue-tracking"
],
"url": "https://github.com/isotope/core/issues/2585"
},
{
"tags": [
"product"
],
"url": "https://github.com/isotope/core"
},
{
"name": "Order::generateUniqueId() returns uniqid() at 2.9.10",
"tags": [
"technical-description"
],
"url": "https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Model/ProductCollection/Order.php#L612-L618"
},
{
"name": "OrderDetails::getCollection() ownership check is conditional on member \u003e 0 at 2.9.10",
"tags": [
"technical-description"
],
"url": "https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Module/OrderDetails.php#L82-L104"
},
{
"name": "VulnCheck Advisory: Isotope eCommerce through 2.9.10 Weak Order Identifier Generation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-weak-order-identifier-generation"
}
],
"title": "Isotope eCommerce through 2.9.10 Weak Order Identifier Generation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96599",
"datePublished": "2026-09-23T14:52:11.965Z",
"dateReserved": "2026-09-23T13:43:56.862Z",
"dateUpdated": "2026-09-24T14:23:24.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94456 (GCVE-0-2026-94456)
Vulnerability from cvelistv5 – Published: 2026-09-22 16:11 – Updated: 2026-09-22 18:11
VLAI
EPSS
VEX
Title
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
Summary
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state.
An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:10 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gitroomhq/postiz-app | product |
| https://github.com/gitroomhq/postiz-app/releases/… | release-notes |
| https://github.com/gitroomhq/postiz-app/commit/92… | patch |
| https://gadvisory.org/advisories/PSA-2026-TD98KY | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GitroomHQ | postiz-app |
Affected:
0 , < 2.4.0
(semver)
|
Date Public
2026-09-22 14:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:10:57.774548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:11:17.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All deployments running the released code up to and including v2.23.0 are affected, self-hosted and hosted alike. The identifier helper is shared code reached by every credential-minting path, and there is no feature flag, environment variable or build option that selects a different random source."
},
{
"lang": "en",
"value": "The anonymous sampling surface, the OAuth dynamic client registration endpoint, is registered in both the default controller set and the MCP_ONLY controller set, so it is reachable in either deployment mode."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Santosh Kumar Puppala"
},
{
"lang": "en",
"type": "coordinator",
"value": "Enno Gelhaus"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nevo David"
}
],
"datePublic": "2026-09-22T14:17:43.125Z",
"descriptions": [
{
"lang": "en",
"value": "Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8\u2019s deterministic xorshift128+ PRNG state.\n\nAn unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state. Once recovered, they can deterministically derive past and future values produced by the same generator, potentially compromising credentials belonging to other users and organizations."
}
],
"exploits": [
{
"lang": "en",
"value": "No public exploit code is known. The original submission was methodology-only and deliberately omitted a working implementation."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker who predicts an OAuth access token minted for another organization is authenticated as that organization with SUPERADMIN rights over the public API, giving full read and write access to its scheduled posts, connected social accounts, media and team membership."
}
]
},
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "The per-organization API key generated at registration is drawn from the same generator and is honoured by the same middleware with the same SUPERADMIN grant, so an attacker sampling the generator around a signup can predict the API key of a newly created organization."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "OAuth client secrets, including those returned by anonymous dynamic client registration and by secret rotation, are predictable, allowing an attacker to impersonate a registered OAuth or MCP client to the token endpoint."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Authorization codes issued at the consent step are predictable, exposing in-flight OAuth authorization flows to interception and redemption by a third party."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "PKCE code verifiers generated for social account connections are predictable, removing the protection PKCE is present to provide for those provider flows."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-330",
"description": "CWE-330",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-341",
"description": "CWE-341",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:16:23.351Z",
"orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"shortName": "postiz"
},
"references": [
{
"name": "Postiz",
"tags": [
"product"
],
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"name": "v2.24.0",
"tags": [
"release-notes"
],
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
},
{
"name": "9259cf24",
"tags": [
"patch"
],
"url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
},
{
"name": "GAdvisory",
"tags": [
"vendor-advisory"
],
"url": "https://gadvisory.org/advisories/PSA-2026-TD98KY"
}
],
"solutions": [
{
"lang": "en",
"value": "Run a Postiz release in which security-sensitive identifiers are generated from a cryptographically secure random source rather than from Math.random(). No fixed release is available at the time of writing; this advisory will record the fixed version once one is published."
},
{
"lang": "en",
"value": "Once running a release with a corrected generator, treat every credential issued by an affected version as compromised and replace it. That covers organization API keys, OAuth application client secrets, and any outstanding OAuth access tokens and authorizations. Outstanding authorization codes are short-lived and expire on their own."
},
{
"lang": "en",
"value": "Operators who connected social accounts while running an affected version should review those connections, since the PKCE verifiers used to establish them were drawn from the same generator."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-21T13:34:00.000Z",
"value": "Postiz has received and acknowledged the report."
},
{
"lang": "en",
"time": "2026-09-21T20:15:00.000Z",
"value": "Postiz has verified the report."
},
{
"lang": "en",
"time": "2026-09-22T04:32:00.000Z",
"value": "Postiz has developed and verified the patch."
},
{
"lang": "en",
"time": "2026-09-22T14:17:00.000Z",
"value": "Postiz has released the patch notes and published the advisory."
}
],
"title": "Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys",
"workarounds": [
{
"lang": "en",
"value": "Blocking or requiring authentication on the OAuth dynamic client registration endpoint at a reverse proxy, gateway or WAF removes the anonymous bulk-sampling surface, which is the part of this issue reachable without an account. It does not make the generated values unpredictable, and it does not close the surfaces available to an authenticated user, so it narrows exposure rather than resolving it. Deployments that do not use OAuth or MCP client integrations can apply this with no loss of function."
},
{
"lang": "en",
"value": "Rotating organization API keys or OAuth client secrets while still running an affected version does not help, and should not be relied on as a mitigation. The replacement value is produced by the same generator and is predictable on the same terms as the value it replaces. Rotation is only meaningful once the generator itself no longer draws from Math.random()."
},
{
"lang": "en",
"value": "Where the deployment allows it, restricting the public API to known client networks limits who can present a predicted credential. This is a containment measure for the consequence rather than a fix for the predictability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"assignerShortName": "postiz",
"cveId": "CVE-2026-94456",
"datePublished": "2026-09-22T16:11:33.674Z",
"dateReserved": "2026-09-21T17:11:13.201Z",
"dateUpdated": "2026-09-22T18:11:17.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92930 (GCVE-0-2026-92930)
Vulnerability from cvelistv5 – Published: 2026-09-22 23:10 – Updated: 2026-09-23 13:42
VLAI
EPSS
VEX
Summary
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4.
Upgrade to version 3.5.4.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:40 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenEye | Apex Network Video Recorder (NVR) |
Affected:
3.2.9.376
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:40:55.835162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:42:26.633Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Apex Network Video Recorder (NVR)",
"vendor": "OpenEye",
"versions": [
{
"status": "affected",
"version": "3.2.9.376"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ryan Wincey (@rwincey, Securifera)"
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T23:19:15.980Z",
"orgId": "c35fbbdf-8d87-49b6-8120-920a36e62b7f",
"shortName": "Securifera"
},
"references": [
{
"url": "https://portal.openeye.net/updates/issue-alerts/1060"
},
{
"url": "https://www.securifera.com/advisories/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to version 3.5.4."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c35fbbdf-8d87-49b6-8120-920a36e62b7f",
"assignerShortName": "Securifera",
"cveId": "CVE-2026-92930",
"datePublished": "2026-09-22T23:10:18.374Z",
"dateReserved": "2026-09-17T12:03:24.121Z",
"dateUpdated": "2026-09-23T13:42:26.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92913 (GCVE-0-2026-92913)
Vulnerability from cvelistv5 – Published: 2026-09-17 11:16 – Updated: 2026-09-17 12:04
VLAI
EPSS
VEX
Title
AVideo Weak PRNG Activation Code Authentication Bypass
Summary
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 12:04 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/avideo-weak-… | third-party-advisory |
Impacted products
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92913",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T12:04:10.693300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T12:04:23.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-v65f-hc7x-wj62"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "c3edcc274c389816d434acadac07ee78eaf330c1",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf(\u0027%08x%05x\u0027, seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server\u0027s exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account\u0027s email address and a User::getUserHash(users_id, \u0027+1 year\u0027) value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T11:16:42.421Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v65f-hc7x-wj62)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-v65f-hc7x-wj62"
},
{
"name": "VulnCheck Advisory: AVideo Weak PRNG Activation Code Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/avideo-weak-prng-activation-code-authentication-bypass"
}
],
"title": "AVideo Weak PRNG Activation Code Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92913",
"datePublished": "2026-09-17T11:16:42.421Z",
"dateReserved": "2026-09-17T11:07:29.772Z",
"dateUpdated": "2026-09-17T12:04:23.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92912 (GCVE-0-2026-92912)
Vulnerability from cvelistv5 – Published: 2026-09-17 11:16 – Updated: 2026-09-19 02:14
VLAI
EPSS
VEX
Title
AVideo Cryptographically Weak PRNG via uniqid Stream Key
Summary
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-19 02:14 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/avideo-crypt… | third-party-advisory |
Impacted products
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92912",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-19T02:14:10.198944Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T02:14:34.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h983-2mcw-672j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "c3edcc274c389816d434acadac07ee78eaf330c1",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T11:16:41.748Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h983-2mcw-672j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h983-2mcw-672j"
},
{
"name": "VulnCheck Advisory: AVideo Cryptographically Weak PRNG via uniqid Stream Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/avideo-cryptographically-weak-prng-via-uniqid-stream-key"
}
],
"title": "AVideo Cryptographically Weak PRNG via uniqid Stream Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92912",
"datePublished": "2026-09-17T11:16:41.748Z",
"dateReserved": "2026-09-17T11:07:29.771Z",
"dateUpdated": "2026-09-19T02:14:34.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86187 (GCVE-0-2026-86187)
Vulnerability from cvelistv5 – Published: 2026-09-05 12:09 – Updated: 2026-09-10 15:05
VLAI
EPSS
VEX
Title
WWBN AVideo Weak PRNG Password Generation via External Login
Summary
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:19 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/wwbn-avideo-… | third-party-advisory |
Impacted products
Date Public
2026-08-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86187",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:19:09.134888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T15:05:16.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "29.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rajivraj"
}
],
"datePublic": "2026-08-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted MD5-based hashing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T12:09:03.422Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h3ff-c2qq-pr2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h3ff-c2qq-pr2g"
},
{
"name": "VulnCheck Advisory: WWBN AVideo Weak PRNG Password Generation via External Login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-weak-prng-password-generation-via-external-login"
}
],
"title": "WWBN AVideo Weak PRNG Password Generation via External Login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86187",
"datePublished": "2026-09-05T12:09:03.422Z",
"dateReserved": "2026-09-05T11:51:31.101Z",
"dateUpdated": "2026-09-10T15:05:16.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82555 (GCVE-0-2026-82555)
Vulnerability from cvelistv5 – Published: 2026-08-30 17:30 – Updated: 2026-08-31 22:04
VLAI
EPSS
VEX
Title
TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
Summary
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 21:50 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397071 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397071/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82555 | third-party-advisory |
| https://vuldb.com/submit/891698 | third-party-advisory |
| https://github.com/b1uerry/cves/tree/main/TOTOLIN… | related |
| https://github.com/b1uerry/cves/blob/main/TOTOLIN… | exploit |
| https://www.totolink.net/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82555",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T21:50:29.685518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T22:04:18.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Authentication Handler"
],
"product": "N600R",
"vendor": "TOTOLINK",
"versions": [
{
"status": "affected",
"version": "4.3.0cu.7866_B20220506"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bluerry (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T17:30:10.581Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397071 | TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397071"
},
{
"name": "VDB-397071 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397071/cti"
},
{
"name": "CVE-2026-82555 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82555"
},
{
"name": "Submit #891698 | TOTOLINK N600R v4.3.0cu.7866_B20220506 Use of Insufficiently Random Values",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/891698"
},
{
"tags": [
"related"
],
"url": "https://github.com/b1uerry/cves/tree/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/b1uerry/cves/blob/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token/poc.py"
},
{
"tags": [
"product"
],
"url": "https://www.totolink.net/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-29T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-29T21:00:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82555",
"datePublished": "2026-08-30T17:30:10.581Z",
"dateReserved": "2026-08-29T18:54:51.440Z",
"dateUpdated": "2026-08-31T22:04:18.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81852 (GCVE-0-2026-81852)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:29 – Updated: 2026-08-31 15:59
VLAI
EPSS
VEX
Title
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Summary
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:59 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81852.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81852 | related |
| https://github.com/ash-project/ash_admin/commit/b… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.10.8 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
99b8daed7b2f79d82fcd9e89338d41b0e1564aa7 , < bc7a1cdf873b16971a8efec35d085f8bb706314f
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:59:13.805623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:59:44.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.10.8",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Router\u0027",
"\u0027Elixir.AshAdmin.Layouts\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/router.ex",
"lib/ash_admin/components/layouts.ex"
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "bc7a1cdf873b16971a8efec35d085f8bb706314f",
"status": "affected",
"version": "99b8daed7b2f79d82fcd9e89338d41b0e1564aa7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application mounts AshAdmin without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e and enforces a nonce-based CSP whose \u003ccode\u003escript-src\u003c/code\u003e allow-lists the default \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e value, and has a separate HTML-injection sink on an admin page.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application mounts AshAdmin without `:csp_nonce_assign_key` and enforces a nonce-based CSP whose `script-src` allow-lists the default `ash_admin-Ed55GFnX` value, and has a separate HTML-injection sink on an admin page."
}
],
"value": "The application mounts AshAdmin without :csp_nonce_assign_key and enforces a nonce-based CSP whose script-src allow-lists the default ash_admin-Ed55GFnX value, and has a separate HTML-injection sink on an admin page."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.10.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\u003c/p\u003e\n\u003cp\u003eWhen mounted without \u003ccode\u003e:csp_nonce_assign_key\u003c/code\u003e, \u003ccode\u003eAshAdmin.Router.ash_admin/2\u003c/code\u003e defaulted the img, style, and script nonces to the literal constant \u003ccode\u003eash_admin-Ed55GFnX\u003c/code\u003e, which \u003ccode\u003eAshAdmin.Layouts\u003c/code\u003e wrote verbatim into the \u003ccode\u003enonce\u003c/code\u003e attribute of its inline \u003ccode\u003e\u0026lt;style\u0026gt;\u003c/code\u003e and \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP \u003ccode\u003escript-src\u003c/code\u003e allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.10.8 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without `:csp_nonce_assign_key`, `AshAdmin.Router.ash_admin/2` defaulted the img, style, and script nonces to the literal constant `ash_admin-Ed55GFnX`, which `AshAdmin.Layouts` wrote verbatim into the `nonce` attribute of its inline `\u003cstyle\u003e` and `\u003cscript\u003e` tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP `script-src` allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"value": "Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.\n\nWhen mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline \u003cstyle\u003e and \u003cscript\u003e tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application\u0027s CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.\n\nThis issue affects ash_admin: from 0.10.8 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:29:14.304Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81852.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81852"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81852",
"datePublished": "2026-08-31T02:29:14.304Z",
"dateReserved": "2026-08-30T23:15:02.378Z",
"dateUpdated": "2026-08-31T15:59:44.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80154 (GCVE-0-2026-80154)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-24 19:10
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Summary
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:31.916185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:14.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:10:15.088Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80154",
"datePublished": "2026-09-22T15:22:33.748Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:10:15.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds.
- In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.
- Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
Mitigation
Implementation
Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Mitigation MIT-2
Architecture and Design
Requirements
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-485: Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.