What’s Vulnerable › Vulnerabilities
CVE-2002-20001
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 24.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-11-11 · updated 2026-09-23
- Weakness: CWE-400
Description
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Affected products
- Balasys Dheater: all versions
- F5 BIG-IP APM: from 13.1.0 before 16.1.4; from 17.0.0 before 17.1.0 — fixed in 16.1.4, 17.1.0
- BIG-IP: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Advanced Web Application Firewall: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Analytics: from 13.1.0 through 17.1.2; 17.5.0
- F5 Networks, Inc. BIG-IP (AAM): from 13.1.0 through 17.1.2; 17.5.0
- BIG-IP ASM: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Application Visibility And Reporting: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Carrier-Grade Nat: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Ddos Hybrid Defender: from 13.1.0 through 17.1.2; 17.5.0
- F5 BIG-IP DNS: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Edge Gateway: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Fraud Protection Service: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Global Traffic Manager: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Link Controller: from 13.1.0 through 17.1.2; 17.5.0
- F5 BIG-IP (LTM): from 13.1.0 through 17.1.2; 17.5.0
- F5 Networks, Inc. BIG-IP (PEM): from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Service Proxy: 1.6.0
- F5 Big-Ip Ssl Orchestrator: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Webaccelerator: from 13.1.0 through 17.1.2; 17.5.0
- F5 Big-Ip Websafe: from 13.1.0 through 17.1.2; 17.5.0
- F5 BIG-IQ: from 8.0.0 through 8.4.0; 7.1.0
- F5OS - Appliance: from 1.3.0 through 1.3.2; from 1.5.0 through 1.5.3; 1.8.0
- F5OS - Chassis: from 1.3.0 through 1.3.2; from 1.6.0 through 1.6.2; 1.5.0, 1.5.1, 1.8.0, 1.8.1
- F5 Traffix SDC: 5.1.0, 5.2.0
- Hewlett Packard Enterprise (HPE) AOS-CX: from 10.06.0000 before 10.06.0180; from 10.07.0000 before 10.07.0030; from 10.08.0000 before 10.08.0010; from 10.09.0000 before 10.09.0002 — fixed in 10.06.0180, 10.07.0030, 10.08.0010, 10.09.0002
- Siemens Scalance W1750D Firmware: all versions
- Stormshield Management Center: before 3.3.3 — fixed in 3.3.3
- Stormshield Network Security: from 2.7.0 before 4.3.16; from 4.4.0 before 4.6.3 — fixed in 4.3.16, 4.6.3
- SUSE Linux Enterprise Server: 11, 12, 15
How to fix
Upgrade to a fixed version: F5 BIG-IP APM 16.1.4, 17.1.0; Hewlett Packard Enterprise (HPE) AOS-CX 10.06.0180, 10.07.0030, 10.08.0010, 10.09.0002; Stormshield Management Center 3.3.3; Stormshield Network Security 4.3.16, 4.6.3. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
- https://dheatattack.com
- https://dheatattack.gitlab.io/
- https://github.com/Balasys/dheater
- https://github.com/mozilla/ssl-config-generator/issues/162
- https://gitlab.com/dheatattack/dheater
- https://ieeexplore.ieee.org/document/10374117
- https://support.f5.com/csp/article/K83120834
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt
- https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/
- https://www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/
- https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol
Get alerted when CVE-2002-20001 or the next vulnerability affects your stack