Technical impact
The vulnerability stems from weak randomness in the Get-RandomPassword function delivered by the BOSH-Ecosystem windows-utilities-release. Because the password is seeded from a predictable clock source, an attacker can estimate the VM boot time and produce a small set of candidate passwords. By brute‑forcing this small list the attacker can recover the local Administrator account that the hardening job was intended to protect. The weakness is classified as CWE‑338, a weak random number generator flaw that compromises confidentiality of privileged credentials.
Affected Systems
All versions of the Cloud Foundry Foundation windows‑utilities‑release older than v0.23.0 are affected. The CWEs linked to this release have been updated in v0.23.0 to use a secure randomizer, eliminating the predictable seed.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate to high severity, with the potential to bypass a core hardening control leading to privilege escalation. Because the exploit requires knowledge of VM boot time, a network‑connected attacker with remote visibility can attempt the attack without requiring direct host access. EPSS is not provided, so the current exploitation probability is unclear, and it is not listed in the KEV catalog. Nonetheless, the impact remains significant for environments that rely on this hardening control.
