Predictable Exact Value from Previous Values
CWE-342
An exact value or random number can be precisely predicted by observing previous values.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6.
How this weakness is prevented
- Increase the entropy used to seed a PRNG.
- Architecture and Design Requirements: Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).
- Implementation: Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.
Latest Predictable Exact Value from Previous Values vulnerabilities
- 7.5 High severity
ADC: Predictable Exact Value from Previous Values
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-7
- 9.1 Critical severity
GOT2000 Series GT21 model: Use of Insufficiently Random Values
Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijac
- 9.1 Critical severity
SICK MSC800: Use of Insufficiently Random Values
The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These f