PT-2023-2545 · Tp Link · Tp-Link T2600G-28Sq
Kuniyuki Hasegawa
·
Publicado
2023-03-15
·
Atualizado
2023-04-18
·
CVE-2023-28368
CVSS v2.0
6.1
Média
| Vetor | AV:A/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
TP-Link L2 switch T2600G-28SQ versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227
Description
The issue is related to errors in handling SSH keys, which can allow a remote attacker to gain unauthorized access to protected information. A fake device may be prepared to spoof the affected device with the vulnerable host key, potentially leading to the obtainment of credential information for the affected device if the administrator is tricked into logging into the fake device.
Recommendations
For versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227, update the firmware to a version that includes a fix for the vulnerable SSH host keys.
As a temporary workaround, consider restricting access to the SSH service until a patch is available.
Avoid using the vulnerable SSH host keys in the affected devices to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Tp-Link T2600G-28Sq