Kyprianos Vasilopoulos

An insufficient entropy issue, caused by the improper use of randomness sources with low entropy for RSA key pair generation, affects the web administration interface. This could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate.

The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library. This is due to incorrect code generation management in certain IBM products. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.