CVE-2023-37426

Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator

High · published August 22, 2023

CVSS v3.1
7.4
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator

host.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00471 · 39.8th percentile
Published
2023-08-22T18:02Z
EPSS history
Timeline
  • 22 AUG 18:02Z
    Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator
    cvelistv5