CVE-2012-3006
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS,...
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
Exploit likelihood
What each source reports
NVD Score used
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
- Record
CVE-2012-3006- CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
- Record
CVE-2012-3006- Updated
- 2026-11-02
EUVDEUVD-2012-2984 No score
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
- Record
EUVD-2012-2984- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jfx-f78m-7wmf No score
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS,...
The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.
- Record
GHSA-6jfx-f78m-7wmf- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3006 is a high vulnerability (CVSS 7.1) in Innominate Mguard Firmware, published June 19, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. No source names a fixed version.
References
freedom-to-tinker.com/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs
innominate.com/data/downloads/software/innominate_security_advisory_20120614_001.pdf
us-cert.gov/control_systems/pdf/ICSA-12-167-01.pdf
nvd.nist.gov/vuln/detail/CVE-2012-3006
github.com/advisories/GHSA-6jfx-f78m-7wmf