Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-45237

22
FAUCET Score

CVE-2023-45237 is a high-severity vulnerability affecting the Network Package in Tianocore EDK2, stemming from a predictable TCP Initial Sequence Number. This flaw allows an unauthenticated remote attacker to gain unauthorized access, potentially leading to a significant loss of confidentiality. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered notable community discussion and media coverage, indicating awareness within the cybersecurity landscape.

Impacted Technologies

VendorProductVersion(s)CPE
<= 202311CPE matchmatch criteria
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.99%
Probability of exploitation in next 30 days
EPSS Percentile
59.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0099 is in the 35th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (23)

ciscopatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 17859-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 18131-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 19674-17086Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: 18132-16823Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: 19678-17086Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: 17321-16823Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: azl3 edk2 20230301gitf80f052277c8-37 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: azl3 edk2 20240223gitedc6681206c1-1 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: cbl2 edk2 20230301gitf80f052277c8-41 on CBL Mariner 2.0Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: cbl2 edk2 20230301gitf80f052277c8-40 on CBL Mariner 2.0Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-11 on CBL Mariner 2.0Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-3 on CBL Mariner 2.0Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 20230301gitf80f052277c8-40
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: edk2-0:20231122-6.el9_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: edk2-0:20221207gitfff6d81270b5-9.el9_2.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: edk2-0:20220126gitbb1bba3d77-13.el8_10.2
View patch
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (4)

ciscollm-cisco-623d3b214f153faeHIGH

HP PC BIOS Security Update for EDK2 NetworkPkg

Oct 24, 2024
microsoft2024-Sep/CVE-2023-45237

CVE-2023-45237

Sep 10, 2024
redhatCVE-2023-45237Moderate

edk2: Use of a Weak PseudoRandom Number Generator

Jan 16, 2024
microsoft2024-Jan/CVE-2023-45237Important

Use of a Weak PseudoRandom Number Generator in EDK II Network Package

Jan 9, 2024

References

kb.cert.org / vuls/id/132380
github.com / tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Vendor Advisory
security.netapp.com / advisory/ntap-20240307-0011
openwall.com / lists/oss-security/2024/01/16/2
Mailing List