CVE-2022-43501

State: Published
Severity: 9.1 Critical
Published: Feb 10, 2023
Updated: Mar 24, 2025
Reserved: Dec 9, 2022

Description

KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may be able to determine the ISN of the current or future TCP connections and either hijack existing ones or spoof future ones.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-330 Use of Insufficiently Random Values

Affected Products

Product	Versions
Kasago IPv6/v4 DualZUKEN Elmic	prior to Ver6.0.1.34Affected
Kasago IPv4ZUKEN Elmic	prior to Ver6.0.1.34Affected
Kasago IPv4 LightZUKEN Elmic	prior to Ver6.0.1.34Affected
Kasago mobile IPv6ZUKEN Elmic	prior to Ver6.0.1.34Affected

References

https://www.elwsc.co.jp/news/6352
Zuken Elmic KASAGO uses insufficient random values for TCP Initial Sequence Numbersthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.