Weak PRNG entropy source used for authentication challenge generation in Motorola MTM5000

CVE-2022-26943

Summary

The firmware for the Motorola MTM5000 series relies solely on a tick count register for generating TETRA authentication challenges, leading to significant weaknesses in randomness. The limited entropy during boot time and lack of adequate re-seeding makes the generation process predictable. An attacker can exploit this weakness by reconstructing the entropy pool through observed authentication challenges, enabling them to derive future authentication responses. This vulnerability facilitates unauthorized access and compromises the confidentiality and integrity of the communication.

References