CVE-2014-0160
mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · functionalEUUSadded 2022-05-04remediate by 2022-05-25
required action Apply updates per vendor instructions.
EPSS · scored 2026-10-23
OpenSSL Information Disclosure Vulnerability
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationmGuardcisa_csaf_ot
All users of the affected mGuard firmware Versions 8.0.0 and 8.0.1 should upgrade to mGuard firmware Version 8.0.2. Innominate recommends users update SSL keys on the affected products after upgrade. The mGuard firmware Version 8.0.2 provides a combined function to replace both the HTTPS and SSH keys.
- MitigationAPE 2.0 (when SSL/TLS component is used in customer implementation)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationCP1543-1 (when FTPS active)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationS7-1500 (when HTTPS active)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationWinCC OA onlycisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - MitigationeLAN-8.2 eLAN (when RIP is used)cisa_csaf_ot
S7-1500 V1.5. The update for S7-1500 V1.5 can be obtained here: (http://support.automation.siemens.com/WW/view/en/67295862/133100)
http://support.automation.siemens.com/WW/view/en/67295862/133100 - Mitigationatvise scadacisa_csaf_ot
Certec has made the new OpenSSL (1.0.1g) libraries available to fix the Heartbleed bug in atvise. The DLLs and the installation instructions can be found on their web site at the following location: (http://www.atvise.com/en/component/phocadownload/category/2-products?download=181:patch-openssl)
http://www.atvise.com/en/component/phocadownload/category/2-products?download=181:patch-openssl - Mitigation650 seriescisa_csaf_ot
The ABB cybersecurity team has issued a Cyber Security Advisory and software maintenance Release 650 series Ver. 1.3.0.1, in order to provide adequate protection to ABB 650 series customers. ABB recommends that this maintenance release be applied, based on customers risk assessment and exposure of the system. For more information, please see the ABB Cyber Security Advisory on the ABB Cyber Security Alerts & Notifications web page at: (http://www.abb.com/cawp/abbzh254/2c9d1261d9fa1dcfc1257950002e4fbf.aspx)
http://www.abb.com/cawp/abbzh254/2c9d1261d9fa1dcfc1257950002e4fbf.aspx - MitigationConnectPortcisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationDigi Embedded Linuxcisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationDigi Embedded Yoctocisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationWireless Vehicle Bus Adapter (WVA)cisa_csaf_ot
Digi International published a Security Notice OpenSSL “Heartbleed” on April 14, 2014, updated on April 18, 2014, at the following URL: (http://www.digi.com/support/kbase/kbaseresultdetl?id=3564)
http://www.digi.com/support/kbase/kbaseresultdetl?id=3564 - MitigationTableau Servercisa_csaf_ot
Schneider Electric Wonderware has issued Security Advisory “Tableau OpenSSL Vulnerability (LFSEC00000098),” available at (user registration required to access this site): (https://wdn.wonderware.com/sites/WDN/Pages/Security%20Central/CyberSecurityUpdates.aspx)
https://wdn.wonderware.com/sites/WDN/Pages/Security%20Central/CyberSecurityUpdates.aspx - MitigationANSI C based OPC UA SDKcisa_csaf_ot
Disable HTTPS transport by configuration in the C++ SDK (default)
- MitigationC++ based OPC UA SDKcisa_csaf_ot
Disable HTTPS transport by configuration in the C++ SDK (default)
- MitigationOpenSSLcisa_csaf_ot
Asset owners and operators should contact their product vendor to check for availability of updates.
- MitigationEKI-132x platform devicescisa_csaf_ot
Update to the latest version. (http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware)
http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (80)
Public proof-of-concept and weaponised exploit code.
- EDB-32745OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosurefunctional · exploit_db
- EDB-32791OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)functional · exploit_db
- EDB-32998OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)functional · exploit_db
- auxiliary/scanner/ssl/openssl_heartbleedOpenSSL Heartbeat (Heartbleed) Information Leakfunctional · metasploit
affected products (84)
Products and version ranges known to be affected.
advisories (9)
Vendor and ecosystem advisories describing this.
- ICSA-14-105-02AInnominate mGuard OpenSSL HeartBleed Vulnerability2014-01-16icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-105-03BSiemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)2014-01-16icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-114-01Certec atvise scada OpenSSL Heartbleed Vulnerability2014-01-25icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-126-01AABB Relion 650 Series OpenSSL Vulnerability (Update A)2014-02-06icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-128-01Digi International OpenSSL Vulnerability2014-02-08icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-02Schneider Electric Wonderware Intelligence Security Patch for OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-04Unified Automation OPC SDK OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-14-135-05OpenSSL Vulnerability2014-02-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
- ICSA-15-344-01BAdvantech EKI Vulnerabilities (Update B)2015-09-12icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (391)
External citations — patches, advisories, analysis.
- http://advisories.mageia.org/MGASA-2014-0165.htmlcnnvd
- http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/cnnvd
- http://cogentdatahub.com/ReleaseNotes.htmlcnnvd
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01cnnvd
- http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=96db9023b881d7cd9f379b0c154650d6c108e9a3cnnvd
- http://heartbleed.com/cnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.htmlcnnvd
- http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan