CVE-2017-5230

CVE-2017-5230 describes a critical vulnerability in all versions of Rapid7 Nexpose prior to 6.4.50, where the Java keystore uses a hardcoded, unchangeable password. This keystore, intended to securely store scan credentials, is thus easily compromised. With a CVSS score of 7.2 (High), an attacker with high privileges can exploit this network-based vulnerability with low complexity, leading to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.