How severe is CVE-2018-12520?

CVE-2018-12520 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-12520 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 11% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-12520?

CVE-2018-12520 affects Ntop Ntopng. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-12520?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-12520 published?

CVE-2018-12520 was published on 2018-07-05 and last updated on 2026-06-17.

CVE-2018-12520

CVE-2018-12520 is a high-severity vulnerability in Ntop Ntopng with a CVSS 3.x base score of 8.1. Its EPSS exploit-prediction score of 11% places it in the 95th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-335.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v2: 6.8
EPSS exploit prediction: 11% (95th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-335
Affected product: Ntop Ntopng
Published: 2018-07-05
Last modified: 2026-06-17

Description

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.

Frequently asked questions

What is CVE-2018-12520?: An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
How severe is CVE-2018-12520?: CVE-2018-12520 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-12520 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 11% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-12520?: CVE-2018-12520 affects Ntop Ntopng. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-12520?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-12520 published?: CVE-2018-12520 was published on 2018-07-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ntop:ntopng:*:*:*:*:*:*:*:*

More vulnerabilities in Ntop Ntopng

CVE-2017-5473 — High (CVSS 8.8): Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the…
CVE-2017-7458 — High (CVSS 7.5): The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a…
CVE-2017-7459 — High (CVSS 7.5): ntopng before 3.0 allows HTTP Response Splitting.
CVE-2017-7416 — Medium (CVSS 6.1): ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.
CVE-2015-8368 — Medium (CVSS 6.0): ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the…
CVE-2014-5464 — Medium (CVSS 4.3): Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1…

All CVEs affecting Ntop Ntopng →

Other CWE-335 vulnerabilities

CVE-2024-36048 — Critical (CVSS 9.8): QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6,…
CVE-2023-4472 — Critical (CVSS 9.8): Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled…
CVE-2012-1577 — Critical (CVSS 9.8): lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
CVE-2019-11495 — Critical (CVSS 9.8): In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server…
CVE-2019-10908 — Critical (CVSS 9.8): In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which…
CVE-2017-11519 — Critical (CVSS 9.8): passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging…

Browse all CWE-335 vulnerabilities →