CVE-2023-28368

Published: Apr 11, 2023Modified: Jun 17, 2026

5.7

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.1 / Impact: 3.6

Source: NVD

Description

TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.

Affected (2)

Products: Tp Link: T2600g 28sq Firmware

1 product

T2600g 28sq Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Tp Link T2600g 28sq Firmware	Version 20190530
Tp Link T2600g 28sq Firmware	Version 20200304

Running on/with	Platform Versions
Tp Link T2600g 28sq	Version 1.0

Related CWEs

Use of Weak Credentials

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

References (4)

https://jvn.jp/en/jp/JVN62420378/

Source: vultures@jpcert.or.jp

Third Party Advisory

https://www.tp-link.com/en/support/download/t2600g-28sq/#Firmware

Source: vultures@jpcert.or.jp

Product

https://jvn.jp/en/jp/JVN62420378/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.tp-link.com/en/support/download/t2600g-28sq/#Firmware

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.