DNN (formerly DotNetNuke) is an open-source CMS platform. The vulnerability causes all new installations of versions 10.x.x up to 10.2.1 to receive the identical Host GUID, which is normally a randomly generated globally unique identifier for each instance. The predictable GUID could allow an adversary to identify or correlate multiple installations, potentially enabling location-based tracking or preemptive attacks on specific hosts. The weakness aligns with CWE‑330, mistakes in the creation or usage of cryptographically strong random identifiers.

Vendor dnnsoftware; product Dnn.Platform. All new installations of DNN 10.x.x through 10.2.1 are affected. The patch is available in version 10.2.2. Upgrades from version 9.x.x are not affected.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the initial installation process, where the globally unique identifier is generated. Because the Host GUID is deterministic, an attacker could potentially infer the presence of other installations or correlate traffic, but exploitation does not provide direct access or code execution. Overall, the risk is moderate and depends on the value placed on the host GUID as a tracking or licensing token.