CVE-2020-27020

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-14 · updated 2026-06-17
Weakness: CWE-326

Description

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).

Affected products

Kaspersky Password Manager for Windows: before 9.2; before 9.2.14.31; before 9.2.14.872; 9.2 — fixed in 9.2, 9.2.14.31, 9.2.14.872

How to fix

Upgrade to a fixed version: Kaspersky Password Manager for Windows 9.2, 9.2.14.31, 9.2.14.872. Check the vendor advisory for mitigations.

References

https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421

Get alerted when CVE-2020-27020 or the next vulnerability affects your stack