The vulnerability arises from the use of a predictable, clock-seeded PRNG in the Get-RandomPassword function within the windows-utilities-release component of the BOSH-Ecosystem. The randomize_password job relies on this function to set an unguessable password for the local Administrator account as a security hardening measure. Because the PRNG is weak, an attacker who can estimate the VM boot time can generate a limited set of candidate passwords and recover the Administrator password, defeating the security control. The vulnerability is tracked as CWE-338 and has a CVSS 3.1 base score of 6.5, indicating medium severity. It affects all versions prior to 0.23.0, with a fix implemented in version 0.23.0.

An attacker with network access who can estimate the VM boot time can recover the Administrator password by reconstructing a small candidate list of possible passwords generated by the weak PRNG. This compromises the local Administrator account, defeating the intended hardening control and potentially allowing unauthorized access to the affected system. There is no indication of impact on confidentiality beyond Administrator account compromise, and no known exploits in the wild have been reported.

A fix is available in windows-utilities-release version 0.23.0 and later. Users should upgrade to version 0.23.0 or newer to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Until upgraded, users should consider the risk of Administrator password compromise due to the weak PRNG.