CVE-2024-23660

Katalog CVE

CVSS 7.5 · High EPSS 0,55%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada binance trust wallet. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.

Rincian

Terbit di NVD

8 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://milksad.info/posts/research-update-5/ exploit · advisory pihak ketiga
• https://secbit.io/blog/en/2024/01/19/trust-wallets-fomo3d-summer-vuln/ exploit · advisory pihak ketiga