CVE-2021-26322
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.0%
exploitation probability
1.0%top 40% of all CVEs
observed exploitation
nono source reports it
In short
The platform stores a private key without proper random protection, which could allow an attacker to recover the key by comparing encrypted messages. This weakens the entire security of the system.
Technical detail
The vulnerability results from reuse of initialization vectors (IVs) when encrypting the platform's private key, enabling two-time pad attacks where an attacker with access to multiple ciphertexts can recover the plaintext key. The issue affects at-rest encryption of persistent cryptographic material without cryptographically random IV generation per encryption operation.
Summary generated and translated by AI from the official description.
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.