📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Root Password Discovery

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below use logic contained within a JAR file and the MAC address to compute a "random" password for the root account. With access to the JAR file and knowledge of the MAC address, it is possible to determine the root password...

ROS-20250710-05

The vulnerability in the Perl programming language is due to the fact that the software uses the function rand as the default entropy source, which is not cryptographically secure. Exploitation of the vulnerability could allow an attacker to bypass the implemented security restrictions...

Vulnerabilities fixed in Schneider Electric EcoStruxture IT Datacenter Expert

Schneider Electric has fixed vulnerabilities in EcoStruxture IT Datacenter Expert. The vulnerabilities include insufficient control over special elements in OS commands, which can result in unauthenticated external code execution. In addition, there is an issue with insufficient entropy in passwo...

Analytic Rényi Entropy Bounds for Device-Independent Cryptography

Device-independent DI cryptography represents the highest level of security, enabling cryptographic primitives to be executed safely on uncharacterized devices. Moreover, with successful proof-of-concept demonstrations in randomness expansion, randomness amplification, and quantum key distributio...

Generalized and Unified Equivalences between Hardness and Pseudoentropy

Pseudoentropy characterizations provide a quantitatively precise demonstration of the close relationship between computational hardness and computational randomness. We prove a unified pseudoentropy characterization that generalizes and strengthens previous results for both uniform and non-unifor...

CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation

Deep Neural Networks DNNs are susceptible to backdoor attacks, where adversaries poison training data to implant backdoor into the victim model. Current backdoor defenses on poisoned data often suffer from high computational costs or low effectiveness against advanced attacks like clean-label and...

Adaptive Variation-Resilient Random Number Generator for Embedded Encryption

With a growing interest in securing user data within the internet-of-things IoT, embedded encryption has become of paramount importance, requiring light-weight high-quality Random Number Generators RNGs. Emerging stochastic device technologies produce random numbers from stochastic physical...

CVE-2025-6931

A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generatepassfrommac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack...

CVE-2025-6931

A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generatepassfrommac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack...

CVE-2025-6931

A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generatepassfrommac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack...

CVE-2025-6931 D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy

A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generatepassfrommac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack...

CVE-2025-6931

CVE-2025-6931 affects D-Link DCS-6517 and DCS-7517 (firmware ≤ 2.02.0). The vulnerability resides in the function generate_pass_from_mac within /bin/httpd of the Root Password Generation Handler, causing insufficient entropy. It supports remote exploitation and is described as high attack complex...

CVE-2025-6931 D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy

A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generatepassfrommac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack...

PT-2025-27482 · D Link · D-Link Dcs-7517 +1

Name of the Vulnerable Software and Affected Versions: D-Link DCS-6517 versions up to 2.02.0 D-Link DCS-7517 versions up to 2.02.0 Description: A vulnerability was found in the function generate pass from mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulati...

D-Link DCS-6517和D-Link DCS-7517 安全特征问题漏洞

The D-Link DCS-6517 and D-Link DCS-7517 are both network cameras from China AUO D-Link. A security signature issue vulnerability exists in D-Link DCS-6517 and D-Link DCS-7517 versions 2.02.0 and earlier, which stems from insufficient entropy in the password generation function...

Don'T Hash Me like That: Exposing and Mitigating Hash-Induced Unfairness in Local Differential Privacy

Local differential privacy LDP has become a widely accepted framework for privacy-preserving data collection. In LDP, many protocols rely on hash functions to implement user-side encoding and perturbation. However, the security and privacy implications of hash function selection have not been...

The vulnerability of the rweather library and the crypto-based solutions for organizing tactical radio communications in hard-to-access areas like Meshtastic allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rweather library and the crypto-based solutions for organizing tactical radio communications in hard-to-access areas like Meshtastic is related to insufficient entropy during key generation. Exploiting this vulnerability allows a remote attacker to compromise the...

Information-Theoretic Estimation of the Risk of Privacy Leaks

Recent work\citeLiu2016 has shown that dependencies between items in a dataset can lead to privacy leaks. We extend this concept to privacy-preserving transformations, considering a broader set of dependencies captured by correlation metrics. Specifically, we measure the correlation between the...

Leakage-Resilient Extractors against Number-On-Forehead Protocols

Given a sequence of $N$ independent sources $\mathbfX1,\mathbfX2,\dots,\mathbfXN\sim\0,1^n$, how many of them must be good i.e., contain some min-entropy in order to extract a uniformly random string? This question was first raised by Chattopadhyay, Goodman, Goyal and Li STOC '20, motivated by...

Dual Protection Ring: User Profiling Via Differential Privacy and Service Dissemination through Private Information Retrieval

User profiling is crucial in providing personalised services, as it relies on analyzing user behaviour and preferences to deliver targeted services. This approach enhances user experience and promotes heightened engagement. Nevertheless, user profiling also gives rise to noteworthy privacy...