Is CVE-2008-0166 being actively exploited?

CVE-2008-0166 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2008-0166?

CVE-2008-0166 has a CVSS 3.1 base score of 7.5 (HIGH).

CVE-2008-0166

HIGH · CVSS 7.5EPSS 70.7%EU EUVD

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

Key facts

CVSS score: 7.5 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-338
EPSS score: 70.7% (99th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2008-0178)
Published: May 13, 2008
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2008-0178 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
openssl / openssl

References

http://metasploit.com/users/hdm/tools/debian-openssl/(Broken Link)
http://secunia.com/advisories/30136(Broken Link, Vendor Advisory)
http://secunia.com/advisories/30220(Broken Link, Vendor Advisory)
http://secunia.com/advisories/30221(Broken Link, Vendor Advisory)
http://secunia.com/advisories/30231(Broken Link, Vendor Advisory)
http://secunia.com/advisories/30239(Broken Link, Vendor Advisory)
http://secunia.com/advisories/30249(Broken Link, Vendor Advisory)
http://sourceforge.net/mailarchive/forum.php?thread_name=48367252.7070603%40shemesh.biz&forum_name=rsyncrypto-devel(Third Party Advisory)
http://www.debian.org/security/2008/dsa-1571(Mailing List, Patch, Vendor Advisory)
http://www.debian.org/security/2008/dsa-1576(Mailing List, Patch)
http://www.kb.cert.org/vuls/id/925211(Third Party Advisory, US Government Resource)
http://www.securityfocus.com/archive/1/492112/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/29179(Broken Link, Exploit, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1020017(Broken Link, Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/usn-612-1(Patch, Third Party Advisory)
http://www.ubuntu.com/usn/usn-612-2(Patch, Third Party Advisory)
http://www.ubuntu.com/usn/usn-612-3(Third Party Advisory)
http://www.ubuntu.com/usn/usn-612-4(Third Party Advisory)
http://www.ubuntu.com/usn/usn-612-7(Third Party Advisory)
http://www.us-cert.gov/cas/techalerts/TA08-137A.html(Broken Link, Third Party Advisory, US Government Resource)
https://16years.secvuln.info
https://exchange.xforce.ibmcloud.com/vulnerabilities/42375(Third Party Advisory, VDB Entry)
https://news.ycombinator.com/item?id=40333169
https://www.exploit-db.com/exploits/5622(Exploit, Third Party Advisory, VDB Entry)
https://www.exploit-db.com/exploits/5632(Exploit, Third Party Advisory, VDB Entry)
https://www.exploit-db.com/exploits/5720(Exploit, Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain