CVE-2022-48506

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48506
A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://dvsorder.org Product
https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x/ Third Party Advisory
https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf Product US Government Resource
https://www.eac.gov/voting-equipment/democracy-suite-517 Product US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:h:dominionvoting:democracy_suite:5.2:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.4-nm:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-b:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-c:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-d:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.7-a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.10:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.10a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.15:*:*:*:*:*:*:*
History

07 Jul 2023, 15:05

Type Values Removed Values Added
References (MISC) https://www.eac.gov/voting-equipment/democracy-suite-517 - (MISC) https://www.eac.gov/voting-equipment/democracy-suite-517 - Product, US Government Resource
References (MISC) https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x/ - (MISC) https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x/ - Third Party Advisory
References (MISC) https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf - (MISC) https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf - Product, US Government Resource
References (MISC) https://dvsorder.org - (MISC) https://dvsorder.org - Product
First Time Dominionvoting
Dominionvoting democracy Suite
CWE CWE-338
CPE cpe:2.3:h:dominionvoting:democracy_suite:5.5:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.10:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-c:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-d:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.4-nm:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.2:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.7-a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.10a:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.5-b:*:*:*:*:*:*:*
cpe:2.3:h:dominionvoting:democracy_suite:5.15:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 2.4

19 Jun 2023, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-19 16:15

Updated : 2024-02-28 20:13

NVD link : CVE-2022-48506

Mitre link : CVE-2022-48506

CVE.ORG link : CVE-2022-48506

JSON object : View

Products Affected

dominionvoting

  • democracy_suite
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)