Test ID:	1.3.6.1.4.1.25623.1.0.150713
Category:	SSL and TLS
Title:	Weak Key Exchange (KEX) Algorithm(s) Supported (SSH)
Summary:	The remote SSH server is configured to allow / support weak key; exchange (KEX) algorithm(s).
Description:	Summary: The remote SSH server is configured to allow / support weak key exchange (KEX) algorithm(s). Vulnerability Insight: - 1024-bit MODP group / prime KEX algorithms: Millions of HTTPS, SSH, and VPN servers all use the same prime numbers for Diffie-Hellman key exchange. Practitioners believed this was safe as long as new key exchange messages were generated for every connection. However, the first step in the number field sieve-the most efficient algorithm for breaking a Diffie-Hellman connection-is dependent only on this prime. A nation-state can break a 1024-bit prime. Vulnerability Impact: An attacker can quickly break individual connections. Solution: Disable the reported weak KEX algorithm(s) - 1024-bit MODP group / prime KEX algorithms: Alternatively use elliptic-curve Diffie-Hellmann in general, e.g. Curve 25519. CVSS Score: 4.6 CVSS Vector: AV:A/AC:H/Au:N/C:C/I:N/A:N
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.