The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side)…
Priority MEDIUM 54CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Why it matters now
EPSS 0.24639 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 76
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:balasys:dheater:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Balasys |
| cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:* | 11 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* | 12 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:* | 15 | Vulnerable | SUSE |
| cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* | 13.1.0 to before 16.1.4; 17.0.0 to before 17.1.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
- cpe:2.3:a:balasys:dheater:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Balasys
- cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* Versions 12 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:* Versions 15 Vulnerable ·SUSE
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 13.1.0 to before 16.1.4; 17.0.0 to before 17.1.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
Show 66 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_analytics:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_domain_name_system:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_edge_gateway:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_fraud_protection_service:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_global_traffic_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_link_controller:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_local_traffic_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_service_proxy:1.6.0:*:*:*:*:kubernetes:*:* | 1.6.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_webaccelerator:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* | 13.1.0 – 17.1.2 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_websafe:17.5.0:*:*:*:*:*:*:* | 17.5.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:* | 8.0.0 – 8.4.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-iq_centralized_management:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.1.0:*:*:*:*:*:*:* | 5.1.0 | Vulnerable | F5 |
| cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.2.0:*:*:*:*:*:*:* | 5.2.0 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:* | 1.3.0 – 1.3.2; 1.5.0 – 1.5.3 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-a:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:* | 1.3.0 – 1.3.2; 1.6.0 – 1.6.2 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-c:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-c:1.5.1:*:*:*:*:*:*:* | 1.5.1 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-c:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | F5 |
| cpe:2.3:o:f5:f5os-c:1.8.1:*:*:*:*:*:*:* | 1.8.1 | Vulnerable | F5 |
| cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* | 10.06.0000 to before 10.06.0180; 10.07.0000 to before 10.07.0030; 10.08.0000 to before 10.08.0010; 10.09.0000 to before 10.09.0002 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_4100i:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6200f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6200m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6300f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6300m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* | before 3.3.3 | Vulnerable | Stormshield |
| cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* | 2.7.0 to before 4.3.16; 4.4.0 to before 4.6.3 | Vulnerable | Stormshield |
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_analytics:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_domain_name_system:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_edge_gateway:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_fraud_protection_service:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_global_traffic_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_link_controller:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_local_traffic_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_service_proxy:1.6.0:*:*:*:*:kubernetes:*:* Versions 1.6.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_webaccelerator:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:* Versions 13.1.0 – 17.1.2 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_websafe:17.5.0:*:*:*:*:*:*:* Versions 17.5.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.4.0 Vulnerable ·F5
- cpe:2.3:a:f5:big-iq_centralized_management:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·F5
- cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·F5
- cpe:2.3:a:f5:traffix_signaling_delivery_controller:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:* Versions 1.3.0 – 1.3.2; 1.5.0 – 1.5.3 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-a:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:* Versions 1.3.0 – 1.3.2; 1.6.0 – 1.6.2 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-c:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-c:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-c:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·F5
- cpe:2.3:o:f5:f5os-c:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·F5
- cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* Versions 10.06.0000 to before 10.06.0180; 10.07.0000 to before 10.07.0030; 10.08.0000 to before 10.08.0010; 10.09.0000 to before 10.09.0002 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_4100i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6200f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6200m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6300f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6300m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:* Versions before 3.3.3 Vulnerable ·Stormshield
- cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* Versions 2.7.0 to before 4.3.16; 4.4.0 to before 4.6.3 Vulnerable ·Stormshield
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2002-20001
- 2026-10-03 Alias added: GHSA-jx4r-qc68-xjr5
References
Advisory 10
- https://github.com/Balasys/dheater
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
- https://www.suse.com/support/kb/doc/?id=000020510
- https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
- https://support.f5.com/csp/article/K83120834
- https://dheatattack.com
- https://gitlab.com/dheatattack/dheater
- https://dheatattack.gitlab.io/
- https://ieeexplore.ieee.org/document/10374117
Sources
- CVE-2002-20001 · CVE Program
- CVE-2002-20001 · NVD
- FIRST EPSS
- GHSA-jx4r-qc68-xjr5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences