Functionality alteration via unreliable update validation

Update validation in Rapid7 Nexpose and InsightVM 6.6.171 and earlier allows attackers to alter product functionality via malicious updates. The update mechanism uses unreliable internal cryptographic validation of received update files, allowing attacker-controlled content to be accepted and applied. Exploitation requires privileged network or local access to supply an update, or social engineering that convinces an administrator to apply it.