Generation of Weak Initialization Vector (IV)
CWE-1204
The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
By design, some cryptographic primitives (such as block ciphers) require that IVs must have certain properties for the uniqueness and/or unpredictability of an IV. Primitives may vary in how important these properties are.
We track 4 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
Latest Generation of Weak Initialization Vector (IV) vulnerabilities
- 8.5 High severity
SwitchBot Lock: Generation of Weak Initialization Vector (IV)
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
- 7.5 High severity
PAGI::Middleware::Session::Store::Cookie: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without
- 7.5 High severity
strongMan: Reusing a Nonce, Key Pair in Encryption
strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database
- 7.5 High severity
Intel(R) IPP Cryptography software library: Generation of Weak Initialization Vector (IV)
Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access.