CVE Vulnerabilities

CVE-2014-2362

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Published: Jul 24, 2014 | Modified: Oct 06, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.8 HIGH
AV:N/AC:M/Au:N/C:C/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Weakness

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG’s algorithm is not cryptographically strong.

Affected Software

Name Vendor Start Version End Version
Sensor_wireless_i/o_module Oleumtech - (including) - (including)
Wio_dh2_wireless_gateway Oleumtech - (including) - (including)

Extended Description

When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.

Potential Mitigations

References