description: The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.
problem types: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
affected:
{
product: Nexpose hardware appliance
vendor: Rapid7
versions:
status: affected, version: All Nexpose hardware appliances shipped before June 2017.
}