CVE-2019-19755: Ethos

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated that they plan to fix this.

Affected products

• Ethos Ethos: up to and including 1.3.3

Published 2024-04-30. Last modified 2026-06-17.