← Vulnerability Intelligence

CVE-2014-0160

High 7.5 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
OpenSSL Information Disclosure Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Metrics

CVSS 3.1
7.5 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — exploit probability
100% (percentile: 100) as of 1 November 2026
CWE
CWE-125

Affected products

openssl: openssl; filezilla-project: filezilla server; siemens: application processing engine firmware; siemens: application processing engine; siemens: cp 1543-1 firmware; siemens: cp 1543-1; siemens: simatic s7-1500 firmware; siemens: simatic s7-1500; siemens: simatic s7-1500t firmware; siemens: simatic s7-1500t; siemens: elan-8.2; siemens: wincc open architecture; intellian: v100 firmware; intellian: v100; intellian: v60 firmware

References