CVE-2021-34600CWE-335

Telenot complex: Insecure AES Key Generation

Medium · published January 20, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.7th percentile
Weakness
CWE-335 · Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Published
2022-01-20T11:40Z
EPSS history
Timeline
  • 20 JAN 11:40Z
    Telenot complex: Insecure AES Key Generation
    cvelistv5