CVE-2025-3495
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.67%
- CWE
- CWE-338
- Published
- 2025-04-16
- Last modified
- 2026-03-12
Affected products
- Delta Electronics COMMGR
Weakness type
Related vulnerabilities
- CVE-2026-74887 — openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
- CVE-2026-74874 — openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
- CVE-2026-73567 — sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
- CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
- CVE-2026-71851 — crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
- CVE-2026-9205 — Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-64798 — Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension
- CVE-2026-16615 — Librest: weak random number generation in pkce implementation