The vulnerability stems from a cryptographically weak random number generator used in the GenerateRandomPassword function of the bosh‑windows‑stemcell‑builder. This flaw produces low‑entropy SSH passwords, enabling an attacker to brute‑force SSH login attempts over TCP/22. The impact is the potential to gain unrestricted access to the virtual machine that hosts the stem cell, compromising confidentiality, integrity, and availability of the platform.

Cloud Foundry Foundation’s bosh‑windows‑stemcell‑builder versions earlier than v2019.98 are affected. Versions v2019.98 and later incorporate a cryptographically secure random number generator, eliminating the low‑entropy password issue.

With a CVSS score of 7.7, the vulnerability is classified as High severity. The EPSS score of < 1% indicates that exploitation probability is currently low, yet the potential for success remains if an attacker chooses to target the exposed SSH service. The vulnerability is not listed in CISA KEV. An attacker would likely exploit the weakness by conducting an automated brute‑force attack against port 22, taking advantage of the limited password entropy generated by the weak RNG. No additional privileges are required beyond the compromised SSH session, providing the attacker full control over the stem cell VM.