CVE-2022-48506

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-485077.5Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect servicCVE-2022-485087.5Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.CVE-2022-485095.9Race condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. Successful exploitation of this vulCVE-2022-48515.3Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-485109.8Input verification vulnerability in the AMS module. Successful exploitation of this vulnerability will cause unauthorized operations.CVE-2022-485119.8Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability maCVE-2022-485129.8Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decodinCVE-2022-485139.8Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-CVE-2022-485147.5The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confCVE-2022-485157.5Vulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentialitCVE-2022-485167.5Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerabilityCVE-2022-485177.5Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.
CVE-2022-48506: Low severity, CVSS 2.4 | Vulnix