Vulnerability · Published Apr 11, 2023 · Assigned by jpcert

CVE-2023-28368

Medium 5.7

In plain English

A medium-severity security flaw in T2600G-28SQ from TP-Link Corporation Limited. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Corporation Limited	T2600G-28SQ	firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227'

Weakness: CWE-1391 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References