CWE-1241 - Use of Predictable Algorithm in Random Number Generator
- Abstraction:Base
- Structure:Simple
- Status:Draft
- Release Date:2020-02-24
- Latest Modification Date:2023-10-26
Weakness Name
Use of Predictable Algorithm in Random Number Generator
Description
The device uses an algorithm that is predictable and generates a pseudo-random number.
Pseudo-random number generator algorithms are predictable because their registers have a finite number of possible states, which eventually lead to repeating patterns. As a result, pseudo-random number generators (PRNGs) can compromise their randomness or expose their internal state to various attacks, such as reverse engineering or tampering. It is highly recommended to use hardware-based true random number generators (TRNGs) to ensure the security of encryption schemes. TRNGs generate unpredictable, unbiased, and independent random numbers because they employ physical phenomena, e.g., electrical noise, as sources to generate random numbers.
Common Consequences
Scope: Confidentiality
Impact: Read Application Data
Related Weaknesses
Max severity RCE flaw discovered in widely used Apache Parquet
Hunters International shifts from ransomware to pure data extortion
CISA warns of Fast Flux DNS evasion used by cybercrime gangs
Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
Ivanti patches Connect Secure zero-day exploited since mid-March
Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware
Texas State Bar warns of data breach after INC ransomware claims attack
Recent GitHub supply chain attack traced to leaked SpotBugs token
CVE-2024-20439 Cisco Smart Licensing Utility Static Credential Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVE-2025-30154 reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability
CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection Vulnerability
CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability
CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
InformationalUser Controllable JavaScript Event (XSS)
MediumJWT Scan Rule
InformationalStorable but Non-Cacheable Content
LowInsufficient Site Isolation Against Spectre Vulnerability
MediumFile Upload
CWE-943 Improper Neutralization of Special Elements in Data Query Logic
CWE-1249 Application-Level Admin Tool with Inconsistent View of Underlying Operating System
HighCWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component