CVE-2002-20001
mediumpriority · attend · 49EPSS 0.246 · 98 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - Fixedphoenix_contact_psirt
Update to the latest 2023.0.0 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- FixedSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
- Mitigationpepperl_fuchs_psirt
External protective measures are required: Disable the webserver after configuration, if possible, by following these steps: - Enable SSH via the web server. - Login to the SSH server. - Disable the webserver via SSH portal. - Reboot the device. or: - Use HTTPS rather than HTTP while using the webserver. - Minimize network exposure for affected products and ensure that they are not accessible via the Internet. - Isolate affected products from the corporate network. - If remote access is required, use secure methods such as virtual private networks(VPNs). Pepperl+Fuchs will provide an update to address some of these vulnerabilities in the future.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
affected products (144)
Products and version ranges known to be affected.
advisories (8)
Vendor and ecosystem advisories describing this.
- SSA-506569SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D2022-11-08csaf · siemens_psirtDE
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens has released updates for the affected products and recommends to update to the latest versions.
- VDE-2023-001PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware2023-02-14csaf · phoenix_contact_psirtDE
A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.
- VDE-2024-017Pepperl+Fuchs: ICE2- * and ICE3- * are affected by multiple vulnerabilities2024-04-10csaf · pepperl_fuchs_psirtDE
Critical vulnerabilities have been discovered in the product due to outdated software components.The impact of the vulnerabilities on the affected device may result in Denial of service Bypassing of authentication Information disclosure
- WID-SEC-W-2022-2251Aruba ClearPass Policy Manager: Mehrere SchwachstellenDeutsch2022-12-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um SQL Injection- und Cross Site Scripting Angriffe durchzuführen, Code zur Ausführung zu bringen, seine Rechte zu erweitern oder Informationen offenzulegen.
- WID-SEC-W-2023-1352TLS Implementierungen: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-12-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen TLS Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2023-1886Sophos Unified Threat Management (UTM) Software: Mehrere SchwachstellenDeutsch2023-07-25csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Sophos Unified Threat Management (UTM) Software ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-3056Diffie-Hellman Implementierungen: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-09-30csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Diffie-Hellman Implementierungen ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.
- ICSA-22-314-10Siemens SCALANCE W1750D2022-11-08icsa · cisa_csaf_otUS
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens has released updates for the affected products and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (43)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfcnnvd
- https://dheatattack.comcnnvd
- https://dheatattack.gitlab.io/cnnvd
- https://github.com/Balasys/dheatercnnvd
- https://github.com/Balasys/dheater。Patchcnnvd
- https://github.com/mozilla/ssl-config-generator/issues/162cnnvd
- https://gitlab.com/dheatattack/dheatercnnvd
- https://ieeexplore.ieee.org/document/10374117cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan