Use of insufficiently random values in ZUKEN ELMIC products - CVE-2022-43501

Vulnerability details

The vulnerability allows a remote attacker to compromise communication between parties and perform spoofing attack.

The vulnerability exists due to usage of its own weak random number generator function when generating TCP initial sequence numbers. A remote attacker can guess the output produced by such generator and hijack future TCP sessions or perform spoofing attack.

Affected software

How to mitigate CVE-2022-43501

External References

• https://jvn.jp/en/vu/JVNVU99551468/index.html
• https://www.elwsc.co.jp/news/6352/
• https://www.elwsc.co.jp/wp-content/uploads//2023/02/KASAGO%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AE%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B202302.pdf

Related Security Bulletins

• Use of insufficiently random values for TCP initial sequence numbers in Zuken Elmic KASAGO products