CVE-2024-25730
Hitrontech Coda-4582U Firmware
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-25730 is a critical-severity Insufficient Entropy (CWE-331) vulnerability in Hitrontech Coda-4582U Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23040
Vulnerability Data
Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Low-entropy default PSKs (5 hex digits + 'Hitron', ~1M possibilities) enable brute-force password guessing (T1110.001) and offline password cracking (T1110.002) of Wi-Fi credentials after handshake capture.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V6.5.2V11.3.4
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Approved key-establishment methods mandate sufficient entropy during key generation, eliminating entropy-starved keys.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly include vetted RNG and entropy sources, directly preventing this weakness while covering many other development concerns.
Password-strength policies implicitly require sufficient entropy, but the control addresses authentication rather than algorithmic randomness.
Proper encryption for data-at-rest requires sufficient entropy for keys/nonces; eliminating the weakness therefore supports but does not fully realize the control.
Cryptographic protection of data-in-transit depends on adequate entropy; the weakness directly undermines the control's effectiveness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of cryptography that must rely on sufficient entropy sources.
Security testing can detect insufficient-entropy defects before release.
Secure-SDLC activities include entropy validation during design and testing.
Secure-coding rules can explicitly forbid weak random-number generation.
Requires secure authentication mechanisms that depend on unpredictable secrets.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331
RHEL 8 (1 rule)
- V-230223 RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331