CVE-2023-4344 - OpenCVE

Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Broadcom	Raid Controller Web Interface

Configuration 1 [-]

cpe:2.3:a:broadcom:raid_controller_web_interface:51.12.0-2779:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.broadcom.com/support/resources/product-security-center
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html

History

Tue, 04 Nov 2025 17:30:00 +0000

Type	Values Removed	Values Added
References		https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html

Tue, 08 Oct 2024 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 05 Sep 2024 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-331

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2023-08-15T18:25:34.072Z

Updated: 2025-11-04T16:10:36.254Z

Reserved: 2023-08-14T21:29:52.908Z

Link: CVE-2023-4344

Vulnrichment

Updated: 2025-11-04T16:10:36.254Z

NVD

Status : Modified

Published: 2023-08-15T19:15:11.943

Modified: 2025-11-04T17:15:41.420

Link: CVE-2023-4344

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-4344", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2023-08-14T21:29:52.908Z", "datePublished": "2023-08-15T18:25:34.072Z", "dateUpdated": "2025-11-04T16:10:36.254Z"}, "containers": {"cna": {"title": "Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection", "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection"}], "affected": [{"vendor": "Broadcom", "product": "LSI Storage Authority (LSA)", "defaultStatus": "affected", "versions": [{"version": "0", "status": "affected", "lessThan": "7.017.011.000", "versionType": "custom"}]}, {"vendor": "Intel", "product": "RAID Web Console 3 (RWC3)", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "7.017.011.000", "versionType": "custom"}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cveClient/1.0.15"}, "credits": [{"lang": "en", "value": "Intel DCG", "type": "finder"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-331", "description": "CWE-331: Insufficient Entropy", "type": "CWE"}]}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}], "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-09-05T21:58:03.947Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}, {"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T16:10:36.254Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T19:24:49.458889Z", "id": "CVE-2023-4344", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T19:26:09.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}, {"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T16:10:36.254Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-4344", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-08T19:24:49.458889Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T19:25:38.931Z"}}], "cna": {"title": "Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Intel DCG"}], "affected": [{"vendor": "Broadcom", "product": "LSI Storage Authority (LSA)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "Intel", "product": "RAID Web Console 3 (RWC3)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "supportingMedia": [{"type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "base64": false}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331: Insufficient Entropy"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2024-09-05T21:58:03.947Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4344", "state": "PUBLISHED", "dateUpdated": "2025-11-04T16:10:36.254Z", "dateReserved": "2023-08-14T21:29:52.908Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2023-08-15T18:25:34.072Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}