CVE Watch18 oct 2026

CVE-2025-52578

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker w

CVSS

5.7

Medio

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 18 nov 2025 · Última mod.: 18 oct 2026 · CWE-335

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-09-242026-10-22

Descripción técnica

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

Referencias oficiales

security.gallagher.comhttps://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-117305.4 MED

7.7%

——2Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.4d CVE-2026-117027.5 ALT

42.5%

——13Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.114d CVE-2026-116257.5 ALT

42.5%

——13Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.114d CVE-2018-146477.5 ALT

95.9%

——29Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.16d