PT-2023-15832 · Dominion Voting Systems · Imagecast Evolution+2

Drew Springall + 1 · Publicado 2023-06-19 · Atualizado 2025-01-02 · CVE-2022-48506

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Baixa

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Democracy Suite versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15

Description A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios.

Recommendations For versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15, consider updating to a version that includes an improved pseudo random number algorithm, such as version 5.17 or later, as mentioned in the Democracy Suite 5.17 EAC Certificate of Conformance. At the moment, there is no other information about a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2022-48506

Produtos afetados

Democracy Suite

Imagecast Evolution

Imagecast Precinct

Referências · 8

• https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x · Nota
• https://t.me/cvenotify/106087 · Publicação no Telegram
• https://dvsorder.org · Nota
• https://eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf · Nota
• https://t.me/cvenotify/53876 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-48506 · Nota de Segurança
• https://t.me/cvenotify/52643 · Publicação no Telegram
• https://eac.gov/voting-equipment/democracy-suite-517 · Nota