PT-2023-2545 · Tp Link · Tp-Link T2600G-28Sq
Kuniyuki Hasegawa
·
Published
2023-03-15
·
Updated
2023-04-18
·
CVE-2023-28368
CVSS v2.0
6.1
Medium
| Vector | AV:A/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
TP-Link L2 switch T2600G-28SQ versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227
Description
The issue is related to errors in handling SSH keys, which can allow a remote attacker to gain unauthorized access to protected information. A fake device may be prepared to spoof the affected device with the vulnerable host key, potentially leading to the obtainment of credential information for the affected device if the administrator is tricked into logging into the fake device.
Recommendations
For versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227, update the firmware to a version that includes a fix for the vulnerable SSH host keys.
As a temporary workaround, consider restricting access to the SSH service until a patch is available.
Avoid using the vulnerable SSH host keys in the affected devices to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tp-Link T2600G-28Sq