CVE-2023-4344— Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
Quick assessment
Affected
Broadcom LSI Storage Authority (LSA)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Broadcom RAID Controller是美国博通（Broadcom）公司的一系列 RAID 控制器。 Broadcom RAID Controller存在安全漏洞，该漏洞源于不正确使用 ssl.rnd 设置 CIM 连接，Web 界面容易受到随机性不足的影响。
Possible ATT&CK Techniques 1 AI
T1552 · Unsecured Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-4344
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
Source: CVE Program / CVE List V5
Vulnerability Description
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息熵不充分
Source: CVE Program / CVE List V5
Vulnerability Title
Broadcom RAID Controller 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Broadcom RAID Controller是美国博通（Broadcom）公司的一系列 RAID 控制器。 Broadcom RAID Controller存在安全漏洞，该漏洞源于不正确使用 ssl.rnd 设置 CIM 连接，Web 界面容易受到随机性不足的影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Broadcom | LSI Storage Authority (LSA) | 0 ~ 7.017.011.000 | - |
|
| Intel | RAID Web Console 3 (RWC3) | 0 ~ 7.017.011.000 | - |
|
II. Public POCs for CVE-2023-4344
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-4344
请登录查看更多情报信息。
Other References for CVE-2023-4344 (1)
Same Patch Batch · Broadcom · 2023-08-15 · 22 CVEs total
| CVE-2023-4333 | Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server | |
| CVE-2023-4345 | Broadcom RAID Controller web interface is vulnerable client-side control bypass | |
| CVE-2023-4323 | Broadcom RAID Controller web interface is vulnerable to improper session management of act | |
| CVE-2023-4324 | Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking H | |
| CVE-2023-4325 | Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has | |
| CVE-2023-4326 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configura | |
| CVE-2023-4327 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the | |
| CVE-2023-4328 | Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and th | |
| CVE-2023-4329 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP confi | |
| CVE-2023-4331 | Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configura | |
| CVE-2023-4332 | Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the lo | |
| CVE-2023-4343 | Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password | |
| CVE-2023-4334 | Broadcom RAID Controller Web server (nginx) is serving private files without any authentic | |
| CVE-2023-4335 | Broadcom RAID Controller Web server (nginx) is serving private server-side files without a | |
| CVE-2023-4336 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP confi | |
| CVE-2023-4337 | Broadcom RAID Controller web interface is vulnerable to improper session handling of manag | |
| CVE-2023-4338 | Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP confi | |
| CVE-2023-4339 | Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for | |
| CVE-2023-4340 | Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the | |
| CVE-2023-4341 | Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: LSI Storage Authority (LSA)
-
CVE-2023-4326
Broadcom RAID Controller web interface is vulnerable has an -
CVE-2023-4325
Broadcom RAID Controller web interface is vulnerable due to -
CVE-2023-4324
Broadcom RAID Controller web interface is vulnerable due to -
CVE-2023-4328
Broadcom RAID Controller web interface is vulnerable to exp -
CVE-2023-4329
Broadcom RAID Controller web interface is vulnerable due to
Same vendor: Broadcom
-
CVE-2026-15380
Local privilege escalation in Symantec ITMS -
CVE-2026-15379
Arbitrary File Read as SYSTEM in Symantec ITMS -
CVE-2026-11626
Local Privilege Escalation in Symantec Endpoint Protection m -
CVE-2026-11815
Insecure Deserialization via MITM in Layer 7 Policy Manager -
CVE-2026-8370
Automic Automation Agent Unix privilege escalation
Same weakness: CWE-331
-
CVE-2026-27490
Combodo iTop: Weak secret generation for inline image -
CVE-2026-4936
Power System Insufficient Entropy -
CVE-2026-4937
Power System Insufficient Entropy -
CVE-2026-19906
pkp pkp-lib API Key Generation APIProfileForm.php setData en -
CVE-2026-19748
Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession
V. Comments for CVE-2023-4344
No comments yet