Rapid7 Nexpose generates new keystore passwords using the generateRandomPassword() method, but the algorithm produces only 7 to 12 character strings that always start with the static prefix 'p'. This minimal entropy creates a very small keyspace, classified as CWE-331. An attacker who can read the nsc.ks file can brute‑force the password on consumer‑grade hardware, decrypting all stored credentials and exposing sensitive data.

The flaw affects Rapid7 InsightVM and Nexpose versions 6.4.50 and later. Users running any release from 6.4.50 upward are at risk.

The CVSS score is 6.8, indicating moderate risk. The EPSS score is below 1%, reflecting a low probability of widespread exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires read or write access to the nsc.ks file, meaning that local compromise or file‑system mis‑configuration are typical attack conditions. Once the password is recovered by brute‑forcing, the attacker gains immediate access to all credentials stored in that keystore.