CWE-336

Same Seed in Pseudo-Random Number Generator (PRNG)

Medium

Description

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

Potential Impact

How to Fix

Architecture and Design

Do not reuse PRNG seeds. Consider a PRNG that periodically re-seeds itself as needed from a high quality pseudo-random output, such as hardware devices.

Architecture and Design

Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-336 vulnerabilities in your codebase.

Get Security Assessment