{"uuid": "a714d816-4337-4ff2-b5f1-45d5e097e005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1561", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/exagrid_known_privkey.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"egypt \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"ExaGrid ships a public/private key pair on their backup appliances to\\n            allow passwordless authentication to other ExaGrid appliances.  Since\\n            the private key is easily retrievable, an attacker can use it to gain\\n            unauthorized remote access as root. Additionally, this module will\\n            attempt to use the default password for root, 'inflection'.\", \"disclosure_date\": \"2016-04-07\", \"fullname\": \"exploit/linux/ssh/exagrid_known_privkey\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"ExaGrid Known SSH Key and Default Password\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/ssh/exagrid_known_privkey.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/ssh/exagrid_known_privkey\", \"references\": [\"CVE-2016-1560\", \"CVE-2016-1561\", \"URL-https://www.rapid7.com/blog/post/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials\", \"ATT&CK-T1021.004\"], \"rport\": 22, \"session_types\": false, \"targets\": [\"Universal\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:23.786797Z"}