CVE-2016-0701: OpenSSL DH_check_pub_key fails to validate DH primes, exposing private exponent

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe CVSS 3.0 score is low (3.7) and exploitation requires a privileged network position and high attack complexity, but the very high EPSS percentile and broad OpenSSL deployment warrant prompt patching.

What it is

OpenSSL 1.0.2 before 1.0.2f does not verify that Diffie-Hellman primes are appropriate for key exchange in DH_check_pub_key. A peer that selects an inappropriate prime (as demonstrated with a number in an X9.42 file) can weaken the DH exchange. This matters because it can lead to recovery of the private DH exponent, undermining the confidentiality of the session key.

Impact

An attacker who can act as the DH peer may recover the victim's private DH exponent, allowing decryption of traffic protected by that key exchange. The CVSS 3.0 vector limits the impact to low confidentiality loss with no integrity or availability effect.

Attack surface

Reachable over the network via the TLS/DH handshake; no authentication or user interaction is required per the CVSS vector (AV:N/AC:H/PR:N/UI:N). The attacker must be positioned as the handshake peer and must supply an inappropriate DH prime, which the description notes can be done through an X9.42 file.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high (0.83645 probability, 99.673 percentile), indicating elevated predicted exploitation activity. The record does not confirm public exploit availability.

What to do

• Upgrade OpenSSL to 1.0.2f or later, or apply the vendor commits 878e2c5b13010329c203f309ed0c8f2113f85648 and c5b831f21d0d29d1e517d139d9d101763f60c9a2.
• Apply the distribution or vendor updates referenced in the OpenSSL security advisory 20160128 and the linked Ubuntu, Fedora, openSUSE, Gentoo, Oracle, HPE, Juniper and Siemens advisories.
• Disable or avoid static DH cipher suites where possible and prefer ECDHE or ephemeral DH with validated parameters.
• Enforce minimum DH parameter sizes and reject non-standard or X9.42-supplied primes in TLS configurations.
• Inventory OpenSSL 1.0.2 versions across servers and embedded products, since the flaw affects the library wherever DH key exchange is used.

Detection

• Search TLS server inventories and package manifests for OpenSSL versions in the 1.0.2 branch prior to 1.0.2f.
• Monitor TLS handshakes for unusually small or non-standard DH primes and for peers presenting X9.42-style DH parameters.
• Review logs for repeated DH handshakes from the same peer, which the description identifies as the mechanism for exponent recovery.
• Track vendor advisories and patch status for products embedding OpenSSL 1.0.2 (Oracle, HPE, Juniper, Siemens) to confirm remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.