PT-2017-16417 · Rapid7+1 · Rapid7 Nexpose+1

Liam Somerville · Published 2017-06-06 · Updated 2019-10-09 · CVE-2017-5243

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose hardware appliances versions prior to June 2017

Description The default SSH configuration does not specify desired algorithms for key exchange and other important functions, allowing all algorithms supported by the relevant version of OpenSSH. This makes the installations vulnerable to man-in-the-middle (MITM), downgrade, and decryption attacks.

Recommendations For Rapid7 Nexpose hardware appliances versions prior to June 2017, consider updating the SSH configuration to specify desired algorithms for key exchange and other important functions to prevent MITM, downgrade, and decryption attacks.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2017-5243

Affected Products

Openssh

Rapid7 Nexpose

References · 3

• https://osv.dev/vulnerability/CVE-2017-5243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5243 · Security Note
• https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2017-13-nexpose-hardware-appliance-ssh-enabled-obsolete-algorithms-cve-2017-5243 · Vendor Advisory