Login
Sign-up
AboutIT4A
SHOPOT Products
SUPPLYSolutions
HOSTSolutions
PROTECTSolutions
CONNECTServices
UsefulRESOURCES
CONTACTIT4A

CVE-2002-20001: Resource Exhaustion Vulnerability in Diffie-Hellman Key Exchange Protocol

Published: June 2, 2025

This Alert Is From MOXA

As Industrial IoT (IIoT) adoption continues to proliferate, cybersecurity has become one of the top priorities. The Moxa Product Security Incident Response Team (PSIRT) takes a proactive approach to protect products from cybersecurity vulnerabilities. Moxa PSIRT investigates all reports of vulnerabilities that could potentially affect Moxa products. Moxa created a vulnerability management policy to provide guidance and information to our customers in the event of a reported vulnerability. The management policy ensures that Moxa’s customers have steady, unambiguous resources to help them understand how Moxa resolves or mitigates reported vulnerabilities. For any queries, please email [email protected].

A resource exhaustion vulnerability, CVE-2002-20001, exists in the implementation of the Diffie-Hellman key exchange protocol.  

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys and trigger expensive server-side DHE modular-exponentiation calculations, also known as a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive where a client can require a server to select its largest supported key size. The basic attack scenario requires the client to claim DHE-only communication capabilities, and the server must be configured to permit DHE. 

This vulnerability affects any product or service that accepts DHE cipher suites. To mitigate the risk, Moxa has released solutions for the affected products. We recommend applying the appropriate solutions immediately. 

The Identified Vulnerability Type and Potential Impact 

CVE ID Vulnerability Type Impact
CVE-2002-20001

CWE-400: Uncontrolled Resource Consumption 

 An attacker can force the server to perform high-cost modular exponentiation operations. This leads to significant CPU usage on the server side, potentially degrading service availability or resulting in a complete denial of service. 

Vulnerability Scoring Details 

CVE ID
Base Score
Vector
 Severity

Unauthenticated

Remote Exploits
CVE-2002-20001 

CVSS:3.1: 7.5 

AV:N/AC:L/PR:N/UI:N/S:U/ C:N/I:N/A:H 

 High  Yes 

 

This alert has come from: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-258261-cve-2002-20001-resource-exhaustion-vulnerability-in-diffie-hellman-key-exchange-protocol