CVE-2002-20001 vulnerability in Balasys and Other Products
Published on November 11, 2021
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Products Associated with CVE-2002-20001
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2002-20001 are published in these products:
Exploit Probability
EPSS
14.68%
Percentile
94.34%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.