PT-2023-15832 · Dominion Voting Systems · Imagecast Evolution+2

Drew Springall + 1 · Published 2023-06-19 · Updated 2025-01-02 · CVE-2022-48506

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Democracy Suite versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15

Description A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios.

Recommendations For versions 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15, consider updating to a version that includes an improved pseudo random number algorithm, such as version 5.17 or later, as mentioned in the Democracy Suite 5.17 EAC Certificate of Conformance. At the moment, there is no other information about a fix for this issue.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2022-48506

Affected Products

Democracy Suite

Imagecast Evolution

Imagecast Precinct

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-48506 · Security Note
• https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x · Note
• https://t.me/cvenotify/106087 · Telegram Post
• https://dvsorder.org · Note
• https://eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf · Note
• https://t.me/cvenotify/53876 · Telegram Post
• https://t.me/cvenotify/52643 · Telegram Post
• https://eac.gov/voting-equipment/democracy-suite-517 · Note