CWE-1241
Use of Predictable Algorithm in Random Number Generator
Description
The device uses an algorithm that is predictable and generates a pseudo-random number.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-97
CVEs mapped to this weakness (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10180 | Hig | 0.49 | 7.5 | 0.04 | Jan 30, 2017 | An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding. | ||
| CVE-2026-26018 | Hig | 0.42 | 7.5 | 0.01 | Mar 6, 2026 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a… | ||
| CVE-2021-3689 | Hig | 0.42 | 7.5 | 0.02 | Aug 10, 2021 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator | ||
| CVE-2026-6420 | — | Med | 0.34 | 6.3 | 0.00 | May 6, 2026 | A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation… | |
| CVE-2025-13079 | Med | 0.34 | 5.3 | 0.00 | Feb 19, 2026 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data.… | ||
| CVE-2021-3692 | Med | 0.28 | 5.3 | 0.02 | Aug 10, 2021 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator | ||
| CVE-2025-32056 | Med | 0.26 | 4.0 | 0.00 | Jan 22, 2026 | The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection. … | ||
| CVE-2021-4241 | Low | 0.10 | 2.6 | 0.01 | Nov 15, 2022 | A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to… | ||
| CVE-2021-4240 | Low | 0.10 | 2.6 | 0.01 | Nov 15, 2022 | A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been… | ||
| CVE-2026-57869 | Hig | 0.00 | — | 0.00 | Jul 7, 2026 | Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3. | ||
| CVE-2023-4695 | Hig | 0.00 | 8.1 | 0.01 | Sep 1, 2023 | Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
- risk 0.49cvss 7.5epss 0.04
An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
- risk 0.42cvss 7.5epss 0.01
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a…
- risk 0.42cvss 7.5epss 0.02
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- risk 0.34cvss 6.3epss 0.00
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation…
- risk 0.34cvss 5.3epss 0.00
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.2. This is due to the plugin generating predictable unsubscribe tokens using deterministic data.…
- risk 0.28cvss 5.3epss 0.02
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
- risk 0.26cvss 4.0epss 0.00
The anti-theft protection mechanism can be bypassed by attackers due to weak response generation algorithms for the head unit. It is possible to reveal all 32 corresponding responses by sniffing CAN traffic or by pre-calculating the values, which allow to bypass the protection. …
- risk 0.10cvss 2.6epss 0.01
A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to…
- risk 0.10cvss 2.6epss 0.01
A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been…
- risk 0.00cvss —epss 0.00
Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.
- risk 0.00cvss 8.1epss 0.01
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.