CVE-2023-28368 Vulnerability Details

  /     /     /  

CVE-2023-28368 Metadata Quick Info

CVE Published: 11/04/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: jpcert | Vendor: TP-Link Corporation Limited | Product: T2600G-28SQ
Status : PUBLISHED

---

CVE-2023-28368 Description

TP-Link L2 switch T2600G-28SQ firmware versions prior to \'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227\' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Use of weak credentials
Source: TP-Link Corporation Limited

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).