PT-2017-7967 · Exagrid · Exagrid

Egypt · Publicado 2016-04-07 · Atualizado 2026-02-28 · CVE-2016-1561

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ExaGrid appliances versions prior to 4.8 P26

Description The issue allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image, due to a default SSH public key in the authorized keys file for root.

Recommendations For versions prior to 4.8 P26, update the firmware to version 4.8 P26 or later to resolve the issue. As a temporary workaround, consider removing the default SSH public key from the authorized keys file for root to prevent unauthorized access.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2026-02408

CVE-2016-1561

Produtos afetados

Exagrid

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/exagrid_known_privkey.rb · Exploit
• 🔥 https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials · Exploit
• 🔥 http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html · Exploit
• 🔥 https://exploit-db.com/exploits/41680 · Exploit
• https://bdu.fstec.ru/vul/2026-02408 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-1561 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1561 · Aviso do Fabricante
• http://rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey · Nota
• https://app.opencve.io/cve/CVE-2016-1561 · Nota