Small Space of Random Values
CWE-334
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
How this weakness is prevented
- Architecture and Design Requirements: Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).
Latest Small Space of Random Values vulnerabilities
- 7.4 High severity
AVHub: Small Space of Random Values
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercep
- 9.0 Critical severity
crypto-js: Insufficient Entropy
crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), ins
- 9.1 Critical severity
MegaBIP: Small Space of Random Values
Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauthenticated attacker who know user login names to brute force these tokens and change account passwords
- 8.8 High severity
Journyx (jtime): Use of Hard-coded Credentials
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
- 7.5 High severity
TETRA Standard: Improper Restriction of Excessive Authentication Attempts
The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystream generation phase, which is insufficient to safeguard against exhaustive search attacks.
- 9.8 Critical severity
MXsecurity Series: Use of Insufficiently Random Values
There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.
- 7.5 High severity
CODESYS Control RTE (SL): Use of Insufficiently Random Values
An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets. This results in the communication channel to be closed.