Vulnerabilities > CVE-2022-26852 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Dell EMC Powerscale Onefs

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

dell

CWE-335

critical

NVD

Published: 2022-04-08

Updated: 2022-04-14

Summary

Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to an account compromise.

Vulnerable Configurations

Part	Description	Count
OS	Dell Dell EMC Powerscale Onefs 8.2.0 Dell EMC Powerscale Onefs 8.2.1 Dell EMC Powerscale Onefs 8.2.2 Dell EMC Powerscale Onefs 9.0.0 Dell EMC Powerscale Onefs 9.0.0.0 Dell EMC Powerscale Onefs 9.1.0 Dell EMC Powerscale Onefs 9.1.0.0 Dell EMC Powerscale Onefs 9.1.0.21 Dell EMC Powerscale Onefs 9.1.0.24 Dell EMC Powerscale Onefs 9.1.0.25 Dell EMC Powerscale Onefs 9.1.0.26 Dell EMC Powerscale Onefs 9.1.0.27 Dell EMC Powerscale Onefs 9.1.1.0 Dell EMC Powerscale Onefs 9.1.1.1 Dell EMC Powerscale Onefs 9.2.0 Dell EMC Powerscale Onefs 9.2.0.0 Dell EMC Powerscale Onefs 9.2.1.0 Dell EMC Powerscale Onefs 9.2.1.17 Dell EMC Powerscale Onefs 9.2.1.18 Dell EMC Powerscale Onefs 9.2.1.19 Dell EMC Powerscale Onefs 9.2.1.20 Dell EMC Powerscale Onefs 9.3.0 Dell EMC Powerscale Onefs 9.3.0.0	23

Common Weakness Enumeration (CWE)

CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

References

https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities