A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
View on MITREThe use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.
Use non-predictable inputs for seed generation.
No detection method information available for this CWE.
Both of these examples use a statistical PRNG seeded with the current value of the system clock to generate a random number:
An attacker can easily predict the seed used by these PRNGs, and so also predict the stream of random numbers generated. Note these examples also exhibit CWE-338 (Use of Cryptographically Weak PRNG).
Both of these examples use a statistical PRNG seeded with the current value of the system clock to generate a random number:
An attacker can easily predict the seed used by these PRNGs, and so also predict the stream of random numbers generated. Note these examples also exhibit CWE-338 (Use of Cryptographically Weak PRNG).
Cloud application on Kubernetes generates passwords using a weak random number generator based on deployment time.
View Detailsserver uses erlang:now() to seed the PRNG, which results in a small search space for potential random seeds
View DetailsThe removal of a couple lines of code caused Debian's OpenSSL Package to only use the current process ID for seeding a PRNG
View Detailscloud provider product uses a non-cryptographically secure PRNG and seeds it with the current time
View DetailsNo relationship information available for this CWE.
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time. The use of predictable seeds significantly reduces the number of possible seeds that an attacker would need to test in order to predict which random numbers will be generated by the PRNG.
If exploited, CWE-337 (Predictable Seed in Pseudo-Random Number Generator (PRNG)) it can compromise Other, leading to outcomes such as Varies by Context.
Recommended mitigations for CWE-337 include: Use non-predictable inputs for seed generation.
CWE-337 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-337, including CVE-2020-7010, CVE-2019-11495, CVE-2008-0166, CVE-2016-10180 and CVE-2018-9057. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-337 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.