CWEweakness

CWE-334 Small Space of Random Values

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

Common consequences

• Access Control, Other: Bypass Protection Mechanism, Other — An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization.

Potential mitigations

• [Architecture and Design, Requirements] Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").

Observed examples

• CVE-2002-0583: Product uses 5 alphanumeric characters for filenames of expense claim reports, stored under web root. • CVE-2002-0903: Product uses a small number of random numbers for a code to approve an action, and also uses predictable new user IDs, allowing attackers to hijack new accounts. • CVE-2003-1230: SYN cookies implementation only uses 32-bit keys, making it easier to brute force ISN. • CVE-2004-0230: Complex predictability / randomness (reduced space).

Related

Observed example · CVE (4)

  • CVE-2004-0230 TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service… vulnerability
  • CVE-2003-1230 The implementation of SYN cookies (syncookies) in FreeBSD 4.5 through 5.0-RELEASE-p3 uses only 32-bit internal keys when generating… vulnerability
  • CVE-2002-0903 register.php for WoltLab Burning Board (wbboard) 1.1.1 uses a small number of random values for the "code" parameter that is provided to… vulnerability
  • CVE-2002-0583 WorkforceROI Xpede 4.1 uses a small random namespace (5 alphanumeric characters) for temporary expense claim reports in the /reports/temp… vulnerability

Child of · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

Referenced by CVE · weakness (14)

  • CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. vulnerability
  • CVE-2024-54017 A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5… vulnerability
  • CVE-2025-3895 Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. vulnerability
  • CVE-2024-52616 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them… vulnerability
  • CVE-2024-51720 An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier… vulnerability
  • CVE-2024-6890 Password reset tokens are generated using an insecure source of randomness. vulnerability
  • CVE-2023-6951 A Use of Weak Credentials vulnerability affecting the Wi-Fi network generated by a set of DJI drones could allow a remote attacker to… vulnerability
  • CVE-2022-24402 The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for… vulnerability
  • CVE-2023-39979 There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. vulnerability
  • CVE-2022-20941 A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated,… vulnerability
  • CVE-2022-33707 Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. vulnerability
  • CVE-2022-22517 An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and… vulnerability
  • CVE-2021-21955 An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy… vulnerability
  • CVE-2020-7566 A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker… vulnerability

Referenced by CWE · child of (1)

  • CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length weakness

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (1)

  • A04:2025 Cryptographic Failures Top 10 2025