1. Home
  2. CVE Database
  3. CVE-2017-5243
HIGH · 8.5

CVE-2017-5243

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls b...

Vulnerability Description

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.

CVSS Score

8.5

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Rapid7Nexpose<= 6.4.40

Related Weaknesses (CWE)

CWE-327

References

FAQ

What is CVE-2017-5243?

CVE-2017-5243 is a vulnerability with a CVSS score of 8.5 (HIGH). The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls b...

How severe is CVE-2017-5243?

CVE-2017-5243 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-5243?

Check the references section above for vendor advisories and patch information. Affected products include: Rapid7 Nexpose.