Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-13199— Insufficient Entropy in Raspberry Pi 5 and Compute Module 5

Quick assessment

Affected

Raspberry Pi Raspberry Pi 5 and Compute Module 5

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Raspberry Pi Raspberry Pi 5 and Compute Module 5是Raspberry Pi基金会的一款嵌入式服务器与计算模块系列。 Raspberry Pi Raspberry Pi 5 and Compute Module 5 28.22-1之前版本存在加密问题漏洞，该漏洞源于EEPROM固件产生了非随机的KASLR和RNG种子值，导致内核地址在启动和设备间一致，可能使其他漏洞更易被利用，同时低质量的RNG种子可能影响随机数质量或因等待其他来源积累足够熵而延迟启动。

AI Predicted 5.3 Difficulty: Theoretical EPSS 0.16% · P6 Updated Jul 07, 2026

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Raspberry Pi	Raspberry Pi 5 and Compute Module 5	`< 28.22-1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13199

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Insufficient Entropy in Raspberry Pi 5 and Compute Module 5

Source: CVE Program / CVE List V5

Vulnerability Description

EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息熵不充分

Source: CVE Program / CVE List V5

Vulnerability Title

Raspberry Pi Raspberry Pi 5 and Compute Module 5 加密问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Raspberry Pi	Raspberry Pi 5 and Compute Module 5	0 ~ 28.22-1	-

II. Public POCs for CVE-2026-13199

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-13199

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13199 (1)

🔗 pieeprom-2026-05-26: 2712: Make Pi 5 use the correct entropy source for kaslr-seed and rng-seed (latest) by timg236 · Pull Request #841 · raspberrypi/rpi-eeprom · GitHub Read full article patch

Vendor Advisories for CVE-2026-13199 (1)

🔗 CVE-2026-13199 | Nozomi Networks Labs third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-13199

IV. Related Vulnerabilities

Same weakness: CWE-331