CVE-2016-0800

MEDIUM

OpenSSL <1.0.1s, 1.0.2 before 1.0.2g - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2016-0800. PoCs published by anthophilee, todb, et, Chris John Riley, including Metasploit module auxiliary/scanner/ssl/ssl_version.

AI-analyzed exploit summary This repository contains a Python-based scanner tool (A2SV) designed to detect multiple SSL/TLS vulnerabilities, including CVE-2015-0204 (FREAK Attack). It automates the scanning process for various CVEs by leveraging Python scripts and dependencies.

Description

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

Exploits (2)

nomisec SCANNER 5 stars
by anthophilee · poc
https://github.com/anthophilee/A2SV--SSL-VUL-Scan

This repository contains a Python-based scanner tool (A2SV) designed to detect multiple SSL/TLS vulnerabilities, including CVE-2015-0204 (FREAK Attack). It automates the scanning process for various CVEs by leveraging Python scripts and dependencies.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: SSL/TLS implementations (various versions)
No auth needed
Prerequisites: Python 2.x · pip2 · git · network access to target
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by todb, et, Chris John Riley · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb

This Metasploit module scans for SSL/TLS vulnerabilities, including CVE-2016-0800 (DROWN), by detecting deprecated protocols, weak ciphers, and certificate issues. It does not exploit vulnerabilities but reports them for further action.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: SSL/TLS servers (various versions)
No auth needed
Prerequisites: Network access to target server · SSL/TLS service running on target
mistral-large-3 · analyzed Jun 17, 2026 Full analysis →

References (63)

Core 63
Core References
Vendor Advisory vendor-advisory
http://rhn.redhat.com/errata/RHSA-2016-1519.html
Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/91787
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/201603-15
Third Party Advisory, VDB Entry vdb-entry
http://www.securityfocus.com/bid/83733
Third Party Advisory, VDB Entry vdb-entry
http://www.securitytracker.com/id/1035133
Various Sources
https://drownattack.com
Third Party Advisory, US Government Resource third-party-advisory
https://www.kb.cert.org/vuls/id/583776

Scores

CVSS v3 5.9
EPSS 0.8211
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200 CWE-310
Status published
Products (28)
openssl/openssl 1.0.1 (4 CPE variants)
openssl/openssl 1.0.1a
openssl/openssl 1.0.1b
openssl/openssl 1.0.1c
openssl/openssl 1.0.1d
openssl/openssl 1.0.1e
openssl/openssl 1.0.1f
openssl/openssl 1.0.1g
openssl/openssl 1.0.1h
openssl/openssl 1.0.1i
... and 18 more
Published Mar 01, 2016
Tracked Since Feb 18, 2026