title: Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key
description: Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
problem types: CWE-321 Use of Hard-coded Cryptographic Key
affected:
{
vendor: Rapid7
product: Nexpose Virtual Appliance
versions:
version: 2017.04.05, status: affected, lessThan: 2017.04.05*, versionType: custom
version: 2017.05.03, status: affected, lessThanOrEqual: 2017.05.03, versionType: custom
}
{
vendor: Rapid7
product: InsightVM Virtual Appliance
versions:
version: 2017.04.05, status: affected, lessThan: 2017.04.05*, versionType: custom
version: 2017.05.03, status: affected, lessThanOrEqual: 2017.05.03, versionType: custom
}
