CVE-2022-26943
The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottime entropy and limited re-seeding of the pool renders the authentication challenge vulnerable to two attacks. First, due to the limited boottime pool entropy, an adversary can derive the contents of the entropy pool by an exhaustive search of possible values, based on an observed authentication challenge. Second, an adversary can use knowledge of the entropy pool to predict authentication challenges. As such, the unit is vulnerable to CVE-2022-24400.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:A/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H
- EPSS probability
- 0.17%
- CWE
- CWE-338
- Published
- 2023-10-19
- Last modified
- 2026-03-13
Affected products
- Motorola Mobile Radio
Weakness type
Related vulnerabilities
- CVE-2025-3495 — COMMGR - Insufficient Randomization Authentication Bypass
- CVE-2025-66565 — Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
- CVE-2025-54883 — Vision UI's security-kit Contains Cryptographic Weakness
- CVE-2025-66630 — Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure
- CVE-2025-67504 — WBCE CMS has Weak Random Number Generator in Password Generation Function
- CVE-2025-15618 — Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key
- CVE-2022-36045 — Account takeover via cryptographically weak PRNG in NodeBB Forum
- CVE-2021-43799 — RabbitMQ exposes ports with weak default secrets in Zulip Server