CVE-2017-5243CWE-327

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other…

published June 6, 2017

CVSS
—
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2017-06-06T16:00Z
EPSS history
Timeline
  • 06 JUN 16:00Z
    The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other…
    cvelistv5