Cyber Resilience

CVE-2026-5083

Berov Ado\ \

Published
08 April 2026
Modified
24 July 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0043 35th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-5083 is a medium-severity PRNG (CWE-338) vulnerability in Berov Ado\. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of…

more

numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1606.001 Web Cookies Credential Access
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
Why these techniques?

Predictable session IDs from weak PRNG enable forging web cookies/sessions for unauthorized access after exploiting the public-facing application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-5082Shared CWE-338, CWE-340
CVE-2026-8503Shared CWE-338, CWE-340
CVE-2026-3256Shared CWE-338, CWE-340
CVE-2026-5080Shared CWE-338, CWE-340
CVE-2025-40920Shared CWE-338, CWE-340
CVE-2026-3255Shared CWE-338, CWE-340
CVE-2026-56016Shared CWE-338, CWE-340
CVE-2026-9692Shared CWE-338, CWE-340
CVE-2026-13577Shared CWE-338, CWE-340
CVE-2025-40926Shared CWE-338, CWE-340

Affected Assets

berov
ado\
\

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-23 Session Authenticity
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)
  • AC-12 Session Termination
Harden
Shrink the surface (DISA STIG)
  • 9 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V7.2.3
  • V11.5.1
  • V11.3.4

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires protection of session authenticity, which fails when session IDs are generated from weak, predictable inputs (rand + PID + time).

prevent

Mandates management of authenticator strength; session IDs function as authenticators and must be generated with sufficient entropy.

respond

Forces session termination after defined conditions, limiting the window during which a guessed ID remains usable.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.

detects

Security testing can detect use of weak random number generators.

prevents

Secure SDLC processes should catch weak PRNG usage during design and code review.

prevents

Application security requirements can specify cryptographically strong random number generation.

prevents

Secure engineering principles include selection of appropriate cryptographic primitives.

prevents

Secure coding standards prohibit use of weak PRNGs in security contexts.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 8 (1 rule)
  • V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340
RHEL 7 (1 rule)
  • V-204497 The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340

References