The

CVE-2014-0160 is the classic *Heartbleed* bug: a missing bounds check in OpenSSL's TLS/DTLS heartbeat handling lets a remote peer read up to 64 KB of process memory per request. The affected upstream range is OpenSSL 1.0.1 through 1.0.1f, fixed in 1.0.1g on 2014-04-07; older 1.0.0 and 0.9.8 branches were not affected, and many Linux vendors shipped backported fixes under distro package versions rather than 1.0.1g literally.

The vendor HIGH 7.5 baseline undersells the operational damage. This is unauthenticated, remotely reachable, trivially automatable, hard to log, and proven capable of exposing private keys, session cookies, credentials, and plaintext from memory; the only meaningful downward friction is that the vulnerable population is now mostly legacy or embedded holdouts, but for any still-exposed asset the blast radius is big enough to treat it as CRITICAL.

Why this verdict

• Upgraded for KEV and real exploitation evidence: CISA KEV inclusion is a hard signal that this was not theoretical lab-only risk.
• No-auth, remote, easy-to-automate: the attacker needs network reachability, not credentials, user clicks, or prior foothold.
• Downstream blast radius exceeds 'info leak' semantics: leaked private keys, cookies, and passwords convert a memory disclosure into impersonation, session hijack, and long-tail trust failure.

Why not higher?

It is not a universal one-shot server takeover primitive. The bug discloses memory rather than directly executing code, and the highest-impact outcomes like private-key recovery are probabilistic and memory-layout dependent, not guaranteed from a single request.

Why not lower?

The normal reasons to downgrade old CVEs do not rescue this one. Yes, the affected upstream range is ancient and population-narrow today, but any remaining exposure is exactly the kind of legacy edge or appliance estate that attackers love: internet-reachable, under-maintained, and holding long-lived credentials and certificates.

1. Remove external reachability — Put vulnerable services behind a non-vulnerable TLS terminator, disable the affected listener, or ACL them to trusted networks only. Because this is CRITICAL and KEV-listed, do this immediately, within hours, not on a routine change cadence.
2. Invalidate trust material — After the vulnerable service is contained, rotate server private keys, reissue certificates, and invalidate active sessions/cookies that may have been resident in memory. Treat this as part of mitigation because patching alone does not un-leak secrets already exposed; execute within hours for internet-facing systems.
3. Force credential hygiene where applicable — If the service stored user credentials or API tokens in process memory, expire or reset them after keys/certs are rotated. Prioritize administrative, service-account, and externally federated identities first, and complete the first wave within hours on exposed systems.
4. Scan for residual exposure — Run remote checks from outside your perimeter and credentialed checks inside the fleet to find stragglers, especially appliances and embedded products that bundle OpenSSL. For a CRITICAL KEV issue, complete the first enterprise-wide sweep within hours and keep rescanning until the exposed count is zero.

Run this from an auditor workstation with Nmap installed, aimed at the *reachable service* rather than the host package database. Invoke it as ./check-heartbleed.sh mail.example.com 443 or ./check-heartbleed.sh vpn.example.com 8443; no root is required for a basic TCP connect scan, but the script needs network reachability to the target port.

#!/usr/bin/env bash
# check-heartbleed.sh
# Remote Heartbleed exposure check using Nmap's ssl-heartbleed NSE script.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error / inconclusive

set -u

HOST="${1:-}"
PORT="${2:-443}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <host> [port]" >&2
  echo "UNKNOWN" >&2
  exit 2
fi

if ! command -v nmap >/dev/null 2>&1; then
  echo "UNKNOWN"
  echo "Reason: nmap is not installed or not in PATH" >&2
  exit 2
fi

TMP_OUT="$(mktemp 2>/dev/null || mktemp -t hbscan)"
trap 'rm -f "$TMP_OUT"' EXIT

# Use a TCP connect scan so root is not required.
# --script-timeout prevents hangs on flaky TLS services.
if ! nmap -Pn -n -sT -p "$PORT" --script ssl-heartbleed --script-timeout 30s "$HOST" >"$TMP_OUT" 2>&1; then
  echo "UNKNOWN"
  echo "Reason: nmap execution failed" >&2
  cat "$TMP_OUT" >&2
  exit 2
fi

# Normalize output checks.
if grep -Eqi 'VULNERABLE|STATE: VULNERABLE' "$TMP_OUT"; then
  echo "VULNERABLE"
  exit 1
fi

if grep -Eqi 'NOT VULNERABLE|does not appear to be vulnerable|ERROR:.*not vulnerable' "$TMP_OUT"; then
  echo "PATCHED"
  exit 0
fi

# If the port is closed/filtered or TLS negotiation failed, report UNKNOWN.
if grep -Eqi 'filtered|closed|Failed to resolve|0 hosts up|handshake failure|ERROR:' "$TMP_OUT"; then
  echo "UNKNOWN"
  cat "$TMP_OUT" >&2
  exit 2
fi

# Last resort: if the script ran but gave no conclusive result, stay conservative.
echo "UNKNOWN"
cat "$TMP_OUT" >&2
exit 2

Sources

1. NVD CVE-2014-0160
2. OpenSSL vulnerabilities index
3. Heartbleed bug FAQ
4. CISA KEV catalog entry
5. Nmap ssl-heartbleed NSE documentation
6. Rapid7 Metasploit Heartbleed scanner module
7. Cloudflare Heartbleed challenge results
8. Debian security tracker for CVE-2014-0160