Kuniyuki Hasegawa

**Name of the Vulnerable Software and Affected Versions** TP-Link L2 switch T2600G-28SQ versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227 **Description** The issue is related to errors in handling SSH keys, which can allow a remote attacker to gain unauthorized access to protected information. A fake device may be prepared to spoof the affected device with the vulnerable host key, potentially leading to the obtainment of credential information for the affected device if the administrator is tricked into logging into the fake device. **Recommendations** For versions prior to T2600G-28SQ(UN) V1 1.0.6 Build 20230227, update the firmware to a version that includes a fix for the vulnerable SSH host keys. As a temporary workaround, consider restricting access to the SSH service until a patch is available. Avoid using the vulnerable SSH host keys in the affected devices to minimize the risk of exploitation.