vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-5242

Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key

HIGH
7.7
CVSS Score
Published: January 12, 2023 at 12:00 AM UTC
Updated: June 17, 2026 at 01:20 AM UTC
2 products affected across 1 vendorInsightVMNexpose

Using Nexpose Virtual Appliance by Rapid7?

Get instant alerts when new vulnerabilities affect Nexpose Virtual Appliance - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.7
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

InsightVM· RAPID7
95%
2017-04-05 ≤ v ≤ 2017-05-032017.04.05 ≤ v < 2017.04.05*2017.04.052017.05.03
Affected range stops below 2017.04.05*, so it looks safe — our inference, not a vendor statement
Nexpose· RAPID7
60%
2017.04.05 ≤ v < 2017.04.05*2017.04.052017.05.03
Affected range stops below 2017.04.05*, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

MitigationVendor Advisory
Source: [email protected]
https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.7HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
HIGH
Privileges
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-321CWE-330

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card