Vulnerability: Insecure Default SSH Configuration in Rapid7 Nexpose Hardware Appliances

CVE-2017-5243 · MEDIUM Severity

AV:N/AC:M/AU:N/C:P/I:P/A:P

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.

Learn more about our Cis Benchmark Audit For Microsoft Exchange Server.