Medium severity · published Dec 5, 2024
CVE-2024-53702
Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by…
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S2
Sma 200 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S2
Sma 210 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S4
Sma 400 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S4
Sma 410 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S5
Sma 500v Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53702
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-53702
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
More from Sma 200 Firmware
9.8
CVE-2021-20038
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
9.8
CVE-2021-20016
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
9.1
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
7.2
CVE-2023-44221
SonicWall SMA100 Appliances OS Command Injection Vulnerability
6.5
CVE-2021-20035
SonicWall SMA100 Appliances OS Command Injection Vulnerability