CVE-2026-3290

HighCVSS 7.4/10Last modified Oct 26, 2026

Description

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

Metrics

CVSS 4.0 7.4/10CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-332

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Silicon LabsRS9116 SDK<= 2.13.1

References

Timeline

Published
May 14, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-329058.3OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized cCVE-2026-329064.3OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolCVE-2026-32915.5Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the applicatiCVE-2026-329139.1OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headeCVE-2026-329148.8OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows commaCVE-2026-329158.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface aCVE-2026-329169.8OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methoCVE-2026-329179.8OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers toCVE-2026-329188.4OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to acceCVE-2026-329196.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logCVE-2026-32928.8A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of tCVE-2026-329208.8OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing
CVE-2026-3290: High severity, CVSS 7.4 | Vulnix