Skip to content
Back to search

CVE-2014-0160

HIGH
7.5 CISA KEVNVD

Summary

generated automatically from NVD data

OpenSSL 1.0.1 before 1.0.1g, known as the Heartbleed bug, mishandles Heartbeat Extension packets in its TLS and DTLS implementations (d1_both.c, t1_lib.c). Crafted packets trigger a buffer over-read (CWE-125) that lets remote attackers read process memory, including private keys. Products from FileZilla Project and Siemens are also listed as affected. The flaw is rated 7.5 (HIGH, CVSS v3.1) and is in the CISA KEV catalog, which indicates active exploitation.

NVD description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-04. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2022-05-25

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

7.5
/ 10.0
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information

Published
7 avr. 2014
Updated
17 juin 2026
Status
Analyzed
Source
secalert@redhat.com

Affected products

openssl opensslAll OpenSSL CVEs →
Versions : 1.0.1g
filezilla-project filezilla server
Versions : 0.9.44
siemens application processing engine firmware
Versions : 2.0
siemens cp 1543-1 firmware
Versions : 1.1
siemens simatic s7-1500 firmware
Versions : 1.5
siemens simatic s7-1500t firmware
Versions : 1.5
siemens elan-8.2
Versions : 8.3.3
siemens wincc open architecture
Versions : 3.12

Weaknesses (CWE)

CWE-125CWE-125

References (257)

Similar CVEs

Other vulnerabilities of type CWE-125

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring