CVE-2022-48506

Katalog CVE

CVSS 2.4 · Low EPSS 0,36%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada dominionvoting democracy suite. Skor CVSS 3.1 2.4 (Low) menurut NVD.

Deskripsi (NVD)

A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.

Rincian

Terbit di NVD

19 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.4 (Low), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNE... product · pemerintah AS
• https://www.eac.gov/voting-equipment/democracy-suite-517 product · pemerintah AS
• https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x/ advisory pihak ketiga
• https://dvsorder.org product