What is CVE-2022-29245?

CVE-2022-29245 is a medium-severity vulnerability in Sshnet Ssh.net, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 6.5/10. Published 2022-05-31.

How severe is CVE-2022-29245?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Sshnet Ssh.net

CVE-2022-29245

SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.

Published 2022-05-31 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.015 (72.6th percentile), scored 2026-10-04.

Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Sshnet Ssh.net — versions >= 2020.0.0, < 2020.0.2
Ssh.net Project — versions 2020.0.0, 2020.0.1

Weakness classification (CWE)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

github.com/sshnet/SSH.NET/security/advisories/GHSA-72p8-v4hg-v45p (Exploit, Third Party Advisory, Mitigation)
github.com/sshnet/SSH.NET/commit/03c6d60736b8f7b42e44d6989a53f9b644a091fb (Patch, Third Party Advisory)
github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Ren… (Exploit, Third Party Advisory)
github.com/sshnet/SSH.NET/releases/tag/2020.0.2 (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2022-29245?: CVE-2022-29245 is a medium-severity vulnerability in Sshnet Ssh.net, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 6.5/10. Published 2022-05-31.
How severe is CVE-2022-29245?: Medium severity. CVSS v3 base score is 6.5 out of 10.