CVE-2025-1860

High

Published: 28 March 2025

Published

28 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0008 24.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1860 is a high-severity Insufficient Entropy (CWE-331) vulnerability in Metacpan (inferred from references). Its CVSS base score is 7.7 (High).

Operationally, ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-12 (Cryptographic Key Establishment and Management) and SC-13 (Cryptographic Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly addresses the CVE by requiring identification, assessment, and timely remediation of the vulnerable Data::Entropy module using weak rand() for entropy.

SC-13 Cryptographic Protection good match

prevent

Requires FIPS-validated cryptographic mechanisms that use secure entropy sources, preventing use of cryptographically weak PRNGs like Perl's rand() in cryptographic functions.

SC-12 Cryptographic Key Establishment and Management good match

prevent

Mandates NIST-approved key establishment and management processes with sufficient entropy, mitigating predictable keys, nonces, or signatures from the insufficient entropy vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.

Confidence: LOW · MITRE ATT&CK Enterprise v19.0

NVD Description

Data::Entropy for Perl 0.007 and earlier use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

Deeper analysisAI

CVE-2025-1860 is a vulnerability in the Data::Entropy Perl module, affecting versions 0.007 and earlier. The module relies on Perl's rand() function as the default entropy source for cryptographic functions, but rand() is not cryptographically secure, leading to predictable outputs that undermine security. This issue is classified under CWE-331 (Insufficient Entropy) and CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator), with a CVSS v3.1 base score of 7.7.

The vulnerability can be exploited by a local attacker with low attack complexity, requiring no privileges (PR:N), no user interaction (UI:N), and local access (AV:L), resulting in unchanged scope (S:U). Exploitation enables high impacts on confidentiality (C:H) and integrity (I:H) with no availability impact (A:N), potentially allowing attackers to predict or forge cryptographic values such as keys, nonces, or signatures used by applications depending on this module.

Advisories provide guidance on mitigation, including a Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/03/msg00026.html. Additional technical details are available in the affected source code at https://metacpan.org/release/ZEFRAM/Data-Entropy-0.007/source/lib/Data/Entropy.pm#L80 and Perl's rand() documentation at https://perldoc.perl.org/functions/rand.