TLS Version 1

Tenable plugin 157288 flags any remote service that will still negotiate TLS 1.1. This is not a product-specific bug and not a CVE; the affected "version range" is simply any endpoint, appliance, middleware stack, or web service configuration that still accepts TLS 1.1. Tenable's own description says the server accepts TLS 1.1 and that TLS 1.1 lacks support for modern recommended cipher constructions such as AEAD/GCM, while RFC 8996 formally deprecated TLS 1.0 and 1.1 in March 2021.

Vendor MEDIUM overstates the operational risk for most enterprises. Supporting TLS 1.1 is usually a configuration hygiene and compliance problem, not a clean initial-access exploit path: an attacker still needs a reachable TLS service plus either a legacy-only client population or an on-path downgrade opportunity, and even then TLS 1.1 alone typically does not yield code execution, auth bypass, or straightforward host takeover. The real exception is internet-facing business-critical endpoints where legacy protocol support widens attack surface and creates compatibility/compliance exposure at scale.

Why this verdict

• Requires more than reachability: discovery is easy, but harmful abuse usually needs an on-path position, downgrade opportunity, or legacy client behavior.
• Not a CVE and no KEV/EPSS pressure: there is no evidence this finding alone is being weaponized at scale as a primary intrusion vector.
• Exposure population is narrow and shrinking: major vendors and browsers have moved to TLS 1.2+ by default, which sharply reduces real-world negotiation of TLS 1.1.
• Blast radius is listener-specific: even when present, the issue is generally confined to one service endpoint or appliance configuration rather than whole-host takeover.

Why not higher?

There is no direct path here to RCE, auth bypass, or privilege escalation. The protocol state mostly becomes dangerous when stacked with separate weaknesses or when deployed on a highly exposed edge service where an attacker can realistically force legacy negotiation.

Why not lower?

It is still a real security signal, especially on internet-facing endpoints, regulated environments, and customer login/payment paths. Deprecated protocol support expands downgrade surface, causes compatibility failures with modern clients, and often coexists with broader TLS hygiene problems that deserve cleanup.

1. Prioritize public edge listeners first — Triage findings by exposure: internet-facing VIPs, external partner gateways, and authentication endpoints first; internal-only appliance listeners later. For a LOW verdict there is no SLA (treat as backlog hygiene), so do this during normal backlog review and change planning.
2. Terminate legacy backends behind a modern proxy — If the backend cannot drop TLS 1.1 yet, place it behind a load balancer or reverse proxy that enforces TLS 1.2/1.3 externally and tightly scopes backend reachability. For LOW, there is no mitigation SLA; use the next standard engineering window rather than emergency change.
3. Constrain who can reach the service — Use ACLs, firewall policy, VPN gating, or management-plane segmentation so only the minimum required client set can hit the legacy listener. This reduces the chance that an attacker can even reach the protocol downgrade surface; for LOW, handle as backlog hygiene.
4. Audit adjacent TLS weaknesses — Pair this finding with cipher-suite, certificate, HSTS, and mutual-auth checks because the real risk usually comes from the combination. Schedule this in the normal hardening program since LOW carries no emergency mitigation or remediation SLA.

Run this from an auditor workstation or jump host that can reach the target service, not on the target server itself. Invoke it as ./check_tls11.sh example.com 443 or ./check_tls11.sh 10.10.10.20 8443 app.example.com; it needs openssl installed and no special privileges beyond network access to the target port.

#!/usr/bin/env bash
# check_tls11.sh
# Test whether a remote service will negotiate TLS 1.1.
# Usage:
#   ./check_tls11.sh <host> <port> [sni]
# Examples:
#   ./check_tls11.sh example.com 443
#   ./check_tls11.sh 10.0.0.15 8443 app.example.com
# Exit codes:
#   0 = VULNERABLE (TLS 1.1 negotiated)
#   1 = PATCHED (TLS 1.1 not negotiated)
#   2 = UNKNOWN (connection/problem determining state)

set -u

HOST="${1:-}"
PORT="${2:-}"
SNI="${3:-${1:-}}"
TIMEOUT_BIN="timeout"

if [[ -z "$HOST" || -z "$PORT" ]]; then
  echo "UNKNOWN - usage: $0 <host> <port> [sni]"
  exit 2
fi

if ! command -v openssl >/dev/null 2>&1; then
  echo "UNKNOWN - openssl not found"
  exit 2
fi

if ! command -v "$TIMEOUT_BIN" >/dev/null 2>&1; then
  TIMEOUT_BIN=""
fi

CMD=(openssl s_client -connect "${HOST}:${PORT}" -servername "$SNI" -tls1_1 -brief)

if [[ -n "$TIMEOUT_BIN" ]]; then
  OUTPUT=$( { "$TIMEOUT_BIN" 10 "${CMD[@]}"; } < /dev/null 2>&1 )
  RC=$?
else
  OUTPUT=$( { "${CMD[@]}"; } < /dev/null 2>&1 )
  RC=$?
fi

# Successful negotiation indicators vary a bit by OpenSSL build.
if echo "$OUTPUT" | grep -Eqi 'Protocol *: *TLSv1\.1|CONNECTION ESTABLISHED|Cipher is|Ciphersuite:'; then
  echo "VULNERABLE - server negotiated TLS 1.1 on ${HOST}:${PORT}"
  exit 0
fi

# Common failure patterns when TLS 1.1 is disabled or unsupported.
if echo "$OUTPUT" | grep -Eqi 'alert protocol version|wrong version number|unsupported protocol|no protocols available|handshake failure|tlsv1 alert protocol version'; then
  echo "PATCHED - TLS 1.1 negotiation failed on ${HOST}:${PORT}"
  exit 1
fi

# Timeouts and network failures are not proof of patch state.
if [[ $RC -ne 0 ]]; then
  echo "UNKNOWN - connection failed or result inconclusive for ${HOST}:${PORT}"
  exit 2
fi

echo "UNKNOWN - unable to determine TLS 1.1 support for ${HOST}:${PORT}"
exit 2

Sources

1. Tenable Nessus Plugin 157288
2. RFC 8996 - Deprecating TLS 1.0 and TLS 1.1
3. Microsoft Learn - TLS 1.0 and TLS 1.1 deprecation in Windows
4. Mozilla Hacks - It's the Boot for TLS 1.0 and TLS 1.1
5. Mozilla Hacks - TLS 1.0 and 1.1 Removal Update
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS FAQ
8. Tenable Connect - Severity Update on TLS Version 1.1 Protocol Detection