The vulnerability is a predictable seed flaw in the Random Number Generator used by HPE NonStop MODULAR NSJ. Because the seed is not sufficiently random, an attacker who can observe or influence the seed may predict subsequent random values. If those values are used for authentication tokens, session identifiers, or cryptographic keys, the system could be susceptible to token forgery or key compromise. The CVSS score of 4.6 indicates a medium severity for the weakness: confidentiality or integrity could be affected if the random data is used in sensitive contexts, but availability is unlikely to be impacted. The weakness corresponds to CWE-337: Insecure Random Number Generation.

All installations of Hewlett Packard Enterprise HPE NonStop MODULAR NSJ that use the affected PRNG implementation are affected. No specific version ranges are listed, so the risk applies to all current releases until a patch is applied.

The EPSS score of less than 1% shows that the likelihood of exploitation in the wild is low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to run code on the target or otherwise influence the PRNG seed, which is generally difficult without privileged access. Consequently, the overall risk is moderate, but the exposure is limited by the specific use of the PRNG in the system. Based on the description, it is inferred that the attack vector requires privileged access or a way to control the seed generation.