This vulnerability arises from the use of a cryptographically weak pseudo-random number generator (PRNG) in the GenerateRandomPassword function within bosh-windows-stemcell-builder. Because the PRNG is weak, the generated passwords can be brute-forced remotely via SSH on TCP port 22. The affected versions are all versions before 2019.98. The CVSS 4.0 base score is 7.7, indicating a high severity with attack vector being adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can remotely brute-force SSH login credentials due to weak password generation, potentially gaining unauthorized access to affected systems. This compromises confidentiality, integrity, and availability of the system accessed via SSH.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the provided information. Users should monitor the vendor's advisories for updates and consider mitigating exposure by restricting SSH access or using additional authentication controls until a fix is available.