| Package | Affected versions | Patched versions |
|---|---|---|
| nexpose | ≤ 6.4.40 |
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free