Fleet generates a 6‑digit PIN for device lock and wipe using only the current Unix timestamp, with no secret key or additional randomness. The PIN is displayed to administrators and used to unlock the device. Because the algorithm is deterministic, an adversary who knows the approximate time a lock command was issued and has physical access to the device could predict the PIN within a limited search window, potentially bypassing the lock. However, the vulnerability does not allow remote exploitation, fleet‑wide compromise, or compromise of Fleet’s authentication controls.

The affected product is Fleet, the open‑source device management platform from fleetdm. All versions earlier than 4.80.1 are vulnerable; version 4.80.1 and later contain the fix.

The CVSS score of 0.6 and an EPSS score of less than one percent indicate a low severity and very limited likelihood of exploitation. The vulnerability requires physical possession of the device, knowledge of the lock time, and the ability to enter PIN guesses before rate limiting or wipe completion prevents further attempts. The issue is not listed in CISA’s KEV catalog.