CVE-2018-25043

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
unspecified	uTorrent	n/a

References

http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/efaq.htmlThird Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1524Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://vuldb.com/?id.113806Exploit, Permissions Required, Third Party Advisory, VDB Entry
http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/efaq.htmlThird Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1524Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://vuldb.com/?id.113806Exploit, Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Jun 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-250448.8A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component G CVE-2018-250456.1Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoe CVE-2018-250469.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2018-250475.4In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and CVE-2018-250488.8The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and CVE-2018-250497.5A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2018-25056.1SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts tha CVE-2018-250506.1A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function A CVE-2018-250516.1A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/cl CVE-2018-250526.1A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function CVE-2018-250536.1A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the f CVE-2018-250545.4A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/sr