Weak Random Password Generation in Bosh Windows Stemcell Builder

Mitigation Strategies

The primary mitigation step is to upgrade bosh-windows-stemcell-builder to version v2019.98 or later, where the weak random number generator issue has been fixed.

Additional immediate steps include:

• Restrict SSH access to trusted IP addresses using firewall rules to reduce exposure.
• Implement strong SSH authentication methods such as key-based authentication instead of password authentication.
• Monitor SSH login attempts closely and respond to any suspicious brute-force activity.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-47831 is a vulnerability in the bosh-windows-stemcell-builder software caused by the use of a cryptographically weak random number generator in its GenerateRandomPassword function.

This weakness allows remote attackers to perform brute-force attacks on SSH login credentials via TCP port 22, potentially gaining unauthorized access.

The issue affects all versions prior to v2019.98.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote attacker to brute-force SSH login credentials, potentially leading to unauthorized access to systems using bosh-windows-stemcell-builder versions prior to v2019.98.

Such unauthorized access could compromise system integrity, confidentiality, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a cryptographically weak random number generator in the GenerateRandomPassword function of bosh-windows-stemcell-builder, which allows brute-force attacks on SSH login via TCP port 22.

To detect this vulnerability on your network or system, you can monitor for unusual or repeated SSH login attempts on TCP port 22, which may indicate brute-force activity exploiting weak passwords.

Commands to help detect such activity include:

• Using SSH logs to identify repeated failed login attempts: `grep 'Failed password' /var/log/auth.log` (Linux) or checking the equivalent SSH log files.
• Using network monitoring tools like `tcpdump` or `wireshark` to capture and analyze traffic on port 22: `tcpdump -i any port 22`.
• Using intrusion detection systems (IDS) such as Snort or Suricata with rules to detect SSH brute-force attempts.

Useful 0 Not Useful 0