Vulnerability in Tp-Link T2600g-28sq
CVE-2023-28368
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.
EPSS: 0.003 (18.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Tp-link T2600g-28sq — versions 1.0
- Tp-link T2600g-28sq_firmware — versions 20190530, 20200304
- Tp-link Corporation Limited T2600g-28sq — versions firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227'
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Product)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-28368?
- CVE-2023-28368 is a medium-severity vulnerability in Tp-Link T2600g-28sq, classified under CWE-1391. CVSS score: 5.7/10. Published 2023-04-11.
- How severe is CVE-2023-28368?
- Medium severity. CVSS v3 base score is 5.7 out of 10.