CVE-2024-25389 Weak cryptography in n/a
RT-Thread uses a weak random number generator, potentially allowing attackers to predict values and bypass security mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25389?
CVE-2024-25389 is a high-severity vulnerability in n/a, published on 27 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drivers/misc/rt_random.c.
Weakness: CWE-338
Which versions are affected by CVE-2024-25389?
It affects 1 product.
Products include Rt-Thread Rt-Thread.
How do I fix CVE-2024-25389?
No fix has been published for CVE-2024-25389 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-25389 being exploited?
There is no known exploitation of CVE-2024-25389 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6c2g-6j82-6fjx.