CVE-2023-28368
low-risk
Published 2023-04-11
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.
Do I need to act?
-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.7/10
Medium
ADJACENT_NETWORK
/ LOW complexity
Affected Products (2)
T2600G-28Sq Firmware
T2600G-28Sq Firmware
Affected Vendors
References (4)
Third Party Advisory
https://jvn.jp/en/jp/JVN62420378/
Third Party Advisory
https://jvn.jp/en/jp/JVN62420378/
26
/ 100
low-risk
Severity
19/34 · Moderate
Exploitability
0/34 · Minimal
Exposure
7/34 · Low