Predictable PIN Generation in Fleet Device Management Software

CVE-2026-23999

What is CVE-2026-23999?

Fleet, an open-source device management software, has a vulnerability where, in versions prior to 4.80.1, device lock and wipe PINs are generated using a predictable algorithm based solely on the current Unix timestamp. This approach does not incorporate any secret key or additional entropy, making it theoretically possible for an attacker with physical access to a locked device and knowledge of the approximate locking time to predict the correct PIN within a limited window. However, successful exploitation requires several factors: direct physical access to the device, knowledge of the specific time the lock command was issued, and the enforcement of rate limits on PIN attempts by the operating system. The risk of exploitation is further mitigated by the quick completion of device wipe operations before an attacker could make sufficient attempts. A patch has been implemented in version 4.80.1, addressing this security concern.

References