CVE-2017-5242

7.7 highEPSS 0.4%

High (7.7) in rapid7 insightvm. EPSS 0.4% chance of exploitation in the next 30 days.

Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.

Severity

CVSS 3.1

7.7 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWEs: CWE-330, CWE-321
Published: 2023-01-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rapid7:insightvm

References

https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/
https://www.rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242/

Check your stack JSON