CVE-2017-5243: RAPID7 Nexpose

High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.

Affected products

• RAPID7 Nexpose: up to and including 6.4.40

Published 2017-06-06. Last modified 2026-06-17.