VulnerabilityModified
CVE-2023-28368
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys.
MEDIUM 5.7EPSS 0.27%
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.
- CVSS 3.1
- 5.7 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.27% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1391
- Affected
- tp-link/t2600g-28sq firmware
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN62420378/Third Party Advisory
- https://www.tp-link.com/en/support/download/t2600g-28sq/#FirmwareProduct
- https://jvn.jp/en/jp/JVN62420378/Third Party Advisory
- https://www.tp-link.com/en/support/download/t2600g-28sq/#FirmwareProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.