CVE-2017-5242: rapid7 insightvm Use of Hard-coded Cryptographic Key

Vulnerability summary

CVE-2017-5242 is a high (CVSS 7.7) Use of Hard-coded Cryptographic Key vulnerability in rapid7 insightvm. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.3% of scored vulnerabilities.

Timeline

1. 12-01-2023
   PublishedVulnerability first disclosed.
2. 08-04-2025
   Last modifiedVulnerability information updated.

Description

Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.

• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.
• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.