CVE-2015-0204

OpenSSL < 0.9.8zd, 1.0.0 < 1.0.0p, 1.0.1 < 1.0.1k - RSA-to-EXPORT_RSA Downgrade Attack via Weak Ephemeral RSA Key

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2015-0204. PoCs published by anthophilee, AbhishekGhosh, scottjpack.

AI-analyzed exploit summary This repository contains a Python-based scanner tool (A2SV) designed to detect multiple SSL/TLS vulnerabilities, including CVE-2015-0204 (FREAK Attack). It automates the scanning process for various CVEs by leveraging Python scripts and dependencies.

Description

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

Exploits (5)

nomisec SCANNER 5 stars
by anthophilee · poc
https://github.com/anthophilee/A2SV--SSL-VUL-Scan

This repository contains a Python-based scanner tool (A2SV) designed to detect multiple SSL/TLS vulnerabilities, including CVE-2015-0204 (FREAK Attack). It automates the scanning process for various CVEs by leveraging Python scripts and dependencies.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: SSL/TLS implementations (various versions)
No auth needed
Prerequisites: Python 2.x · pip2 · git · network access to target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 5 stars
by AbhishekGhosh · poc
https://github.com/AbhishekGhosh/FREAK-Attack-CVE-2015-0204-Testing-Script

This repository contains a BASH script to test for the FREAK Attack (CVE-2015-0204) by checking if a server supports EXPORT-grade cipher suites. It automates OpenSSL-based testing as described by Akamai.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: OpenSSL and servers supporting EXPORT-grade cipher suites
No auth needed
Prerequisites: OpenSSL installed on the system · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 4 stars
by scottjpack · poc
https://github.com/scottjpack/Freak-Scanner

This is a multithreaded Python scanner designed to detect SSL EXP Ciphers vulnerable to CVE-2015-0204 (FREAK attack). It uses OpenSSL to test for export-grade cipher suites on a list of provided IPs or CIDR ranges.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: OpenSSL and other SSL/TLS implementations supporting EXPORT ciphers
No auth needed
Prerequisites: List of target IPs or CIDR ranges · OpenSSL installed on the system
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2 stars
by felmoltor · poc
https://github.com/felmoltor/FreakVulnChecker

This repository contains a Bash script that checks if a server is vulnerable to CVE-2015-0204 (FREAK attack) by testing for support of EXPORT cipher suites. It uses OpenSSL to test connections and outputs results in a CSV file.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Servers supporting EXPORT cipher suites
No auth needed
Prerequisites: OpenSSL installed locally · Network access to target servers
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 1 stars
by niccoX · poc
https://github.com/niccoX/patch-openssl-CVE-2014-0291_CVE-2015-0204

This repository provides an Ansible playbook to patch OpenSSL vulnerabilities CVE-2015-0291 and CVE-2015-0204 on RedHat-based systems. It includes instructions for testing vulnerability status and applying patches.

Classification
Writeup 100%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: OpenSSL (RedHat Family OS)
Auth required
Prerequisites: Ansible installed · Inventory file with target servers · SSH access to target systems
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (66)

Core 66
Core References
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142895206924048&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142720981827617&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=144050155601375&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=143748090628601&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=144043644216842&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142721102728110&w=2
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:019
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/99707
Vendor Advisory x_refsource_confirm
http://support.novell.com/security/cve/CVE-2015-0204.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=143213830203296&w=2
Vendor Advisory x_refsource_misc
https://freakattack.com/
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:063
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21883640
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142496289803847&w=2
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Various Sources x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa91
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=144050297101809&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91787
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=144050205101530&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=142496179803395&w=2
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:062
Vendor Advisory x_refsource_confirm
https://support.citrix.com/article/CTX216642
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=144050254401665&w=2
Various Sources x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa88
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201503-11
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3125
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0849.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0066.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1650.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0800.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/71936
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT204659
Vendor Advisory x_refsource_confirm
https://www.openssl.org/news/secadv_20150319.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033378
Vendor Advisory x_refsource_confirm
https://www.openssl.org/news/secadv_20150108.txt

Scores

EPSS 0.9869
EPSS Percentile 99.9%

Details

CWE
CWE-310
Status published
Products (26)
openssl/openssl 1.0.0a
openssl/openssl 1.0.0b
openssl/openssl 1.0.0c
openssl/openssl 1.0.0d
openssl/openssl 1.0.0e
openssl/openssl 1.0.0f
openssl/openssl 1.0.0g
openssl/openssl 1.0.0h
openssl/openssl 1.0.0i
openssl/openssl 1.0.0j
... and 16 more
Published Jan 09, 2015
Tracked Since Feb 18, 2026