# What is CVE-2021-3449?

> CVE-2021-3449 is a medium-severity flaw (CVSS 5.9) in OpenSSL, published on 25 March 2021. It is not on the list of flaws known to be exploited today. The latest forecast puts its chance of use in the next 30 days at 64%. If you run an affected version, plan in the vendor’s fix.

Canonical page: https://www.precursorintelligence.com/what-is/cve-2021-3449

## At a glance

- **Verdict:** Fix this soon. Not confirmed as exploited yet, but serious or likely enough that it should not wait for a quiet month.
- **Precursor Intelligence risk score:** 49 out of 100 (Medium); action: Plan remediation. Kept up to date as the evidence changes.
- **Severity:** Medium (CVSS 5.9 out of 10)
- **Known to be exploited:** No, not on the list of flaws known to be exploited today
- **Chance of use in the next 30 days:** 64% (latest exploit-likelihood forecast)
- **Published:** 25 March 2021
- **Record last updated:** 21 June 2024
- **Main product:** OpenSSL
- **Affected products:** 167

## What is CVE-2021-3449? In plain terms

It can be attacked from anywhere on the internet without logging in, and nobody has to click anything. If it works, the attacker can take it offline.

### The official description

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

### What kind of flaw is it?

- CWE-476: NULL Pointer Dereference

### How an attack on it works

- Where an attacker can be: Anywhere on the internet
- How hard it is to pull off: Hard: conditions must line up
- Login needed first: No login needed
- Does someone have to click: No, nobody has to do anything
- What an attacker gets: Can take it offline

Severity vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`

## Is CVE-2021-3449 being exploited? Not that we know of

It is not on the list of flaws known to be exploited today. The latest forecast puts the chance of it being used in the next 30 days at 64%. That can change at any time, which is why we keep watching.

Exploit likelihood over the last 7 days: 64%, 64%, 64%, 64%, 64%, 64%, 64%.

### Timeline

- 25 March 2021: Published
- 21 June 2024: Record last updated
- 19 November 2025: Exploit likelihood jumped
- 22 November 2025: Exploit likelihood fell

### How Precursor Intelligence ranks it

CVE-2021-3449 scores **49 out of 100 (Medium)**, with the action "Plan remediation".

Every published flaw gets a risk score from 0 to 100, kept up to date as the evidence changes. Four things go into the score, from the one that counts most to the ones that count less:

- Evidence it is being exploited: biggest factor
- How severe it is: strong factor
- How widely exposed it is: smaller factor
- Threat activity around it: smaller factor

85 and above is Critical. Anything confirmed as exploited is always marked for an emergency patch, whatever its score. When this flaw matches software you track, it lands in your list with its score and the reasons behind it.

## Who is affected by CVE-2021-3449?

The published record lists 167 products. Versions are as published: "1.1.1 to before 1.1.1k" means from 1.1.1 up to, but not including, 1.1.1k.

- [OpenSSL](https://www.precursorintelligence.com/product/openssl/openssl) by [OpenSSL](https://www.precursorintelligence.com/vendors/openssl) (Application): 1.1.1 to before 1.1.1k
- [Node.js](https://www.precursorintelligence.com/product/nodejs/node.js) by [Nodejs](https://www.precursorintelligence.com/vendors/nodejs) (Application): 10.0.0 to 10.12.0, 10.13.0 to 10.24.0, 12.0.0 to 12.12.0, 12.13.0 to before 12.22.1, 14.0.0 to 14.14.0, 14.15.0 to before 14.16.1, 15.0.0 to before 15.14.0
- [Nessus Network Monitor](https://www.precursorintelligence.com/product/tenable/nessus_network_monitor) by [Tenable](https://www.precursorintelligence.com/vendors/tenable) (Application): 5.11.0, 5.11.1, 5.12.0, 5.12.1, 5.13.0
- [Sinema Server](https://www.precursorintelligence.com/product/siemens/sinema_server) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): 14.0, 14.0-sp1, 14.0-sp2, 14.0-sp2_update1, 14.0-sp2_update2
- [Primavera Unifier](https://www.precursorintelligence.com/product/oracle/primavera_unifier) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 17.7 to 17.12, 19.12, 20.12, 21.12
- [FreeBSD](https://www.precursorintelligence.com/product/freebsd/freebsd) by [FreeBSD](https://www.precursorintelligence.com/vendors/freebsd) (Operating system): 12.2, 12.2-p1, 12.2-p2
- [Graalvm](https://www.precursorintelligence.com/product/oracle/graalvm) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 19.3.5, 20.3.1.2, 21.0.0.2
- [Peoplesoft Enterprise Peopletools](https://www.precursorintelligence.com/product/oracle/peoplesoft_enterprise_peopletools) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 8.57, 8.58, 8.59
- [Web Gateway](https://www.precursorintelligence.com/product/mcafee/web_gateway) by [Mcafee](https://www.precursorintelligence.com/vendors/mcafee) (Application): 8.2.19, 9.2.10, 10.1.1
- [Web Gateway Cloud Service](https://www.precursorintelligence.com/product/mcafee/web_gateway_cloud_service) by [Mcafee](https://www.precursorintelligence.com/vendors/mcafee) (Application): 8.2.19, 9.2.10, 10.1.1
- [Debian Linux](https://www.precursorintelligence.com/product/debian/debian_linux) by [Debian](https://www.precursorintelligence.com/vendors/debian) (Operating system): 9.0, 10.0
- [Multi-Domain Management Firmware](https://www.precursorintelligence.com/product/checkpoint/multi-domain_management_firmware) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Operating system): r80.40, r81
- [Mysql Server](https://www.precursorintelligence.com/product/oracle/mysql_server) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): up to 5.7.33, 8.0.15 to 8.0.23
- [Quantum Security Gateway Firmware](https://www.precursorintelligence.com/product/checkpoint/quantum_security_gateway_firmware) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Operating system): r80.40, r81
- [Quantum Security Management Firmware](https://www.precursorintelligence.com/product/checkpoint/quantum_security_management_firmware) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Operating system): r80.40, r81
- [Simatic Logon](https://www.precursorintelligence.com/product/siemens/simatic_logon) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): 1.5-sp3_update_1, 1.6.0.2 and later
- [Sinec Nms](https://www.precursorintelligence.com/product/siemens/sinec_nms) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): 1.0, 1.0-sp1
- [Active Iq Unified Manager](https://www.precursorintelligence.com/product/netapp/active_iq_unified_manager) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Capture Client](https://www.precursorintelligence.com/product/sonicwall/capture_client) by [SonicWall](https://www.precursorintelligence.com/vendors/sonicwall) (Application): 3.5
- [Cloud Volumes Ontap Mediator](https://www.precursorintelligence.com/product/netapp/cloud_volumes_ontap_mediator) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Communications Communications Policy Management](https://www.precursorintelligence.com/product/oracle/communications_communications_policy_management) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 12.6.0.0.0
- [E-Series Performance Analyzer](https://www.precursorintelligence.com/product/netapp/e-series_performance_analyzer) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Enterprise Manager for Storage Management](https://www.precursorintelligence.com/product/oracle/enterprise_manager_for_storage_management) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 13.4.0.0
- [Essbase](https://www.precursorintelligence.com/product/oracle/essbase) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 21.2
- [Fedora](https://www.precursorintelligence.com/product/fedoraproject/fedora) by [Fedoraproject](https://www.precursorintelligence.com/vendors/fedoraproject) (Operating system): 34
- [Jd Edwards Enterpriseone Tools](https://www.precursorintelligence.com/product/oracle/jd_edwards_enterpriseone_tools) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): before 9.2.6.0
- [Jd Edwards World Security](https://www.precursorintelligence.com/product/oracle/jd_edwards_world_security) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): a9.4
- [Log Correlation Engine](https://www.precursorintelligence.com/product/tenable/log_correlation_engine) by [Tenable](https://www.precursorintelligence.com/vendors/tenable) (Application): before 6.0.9
- [Multi-Domain Management](https://www.precursorintelligence.com/product/checkpoint/multi-domain_management) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Hardware): version not specified
- [Mysql Connectors](https://www.precursorintelligence.com/product/oracle/mysql_connectors) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): up to 8.0.23
- [Mysql Workbench](https://www.precursorintelligence.com/product/oracle/mysql_workbench) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): up to 8.0.23
- [Nessus](https://www.precursorintelligence.com/product/tenable/nessus) by [Tenable](https://www.precursorintelligence.com/vendors/tenable) (Application): up to 8.13.1
- [Oncommand Insight](https://www.precursorintelligence.com/product/netapp/oncommand_insight) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Oncommand Workflow Automation](https://www.precursorintelligence.com/product/netapp/oncommand_workflow_automation) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Ontap Select Deploy Administration Utility](https://www.precursorintelligence.com/product/netapp/ontap_select_deploy_administration_utility) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Quantum Security Gateway](https://www.precursorintelligence.com/product/checkpoint/quantum_security_gateway) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Hardware): version not specified
- [Quantum Security Management](https://www.precursorintelligence.com/product/checkpoint/quantum_security_management) by [Checkpoint](https://www.precursorintelligence.com/vendors/checkpoint) (Hardware): version not specified
- [Ruggedcom Rcm1224](https://www.precursorintelligence.com/product/siemens/ruggedcom_rcm1224) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Ruggedcom Rcm1224 Firmware](https://www.precursorintelligence.com/product/siemens/ruggedcom_rcm1224_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 6.2 and later
- [Santricity Smi-S Provider](https://www.precursorintelligence.com/product/netapp/santricity_smi-s_provider) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Scalance Lpe9403](https://www.precursorintelligence.com/product/siemens/scalance_lpe9403) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Lpe9403 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_lpe9403_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Scalance M-800](https://www.precursorintelligence.com/product/siemens/scalance_m-800) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance M-800 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_m-800_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 6.2 and later
- [Scalance S602](https://www.precursorintelligence.com/product/siemens/scalance_s602) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance S602 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_s602_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 4.1 and later
- [Scalance S612](https://www.precursorintelligence.com/product/siemens/scalance_s612) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance S612 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_s612_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 4.1 and later
- [Scalance S615](https://www.precursorintelligence.com/product/siemens/scalance_s615) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance S615 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_s615_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 6.2 and later
- [Scalance S623](https://www.precursorintelligence.com/product/siemens/scalance_s623) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance S623 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_s623_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 4.1 and later
- [Scalance S627-2m](https://www.precursorintelligence.com/product/siemens/scalance_s627-2m) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance S627-2m Firmware](https://www.precursorintelligence.com/product/siemens/scalance_s627-2m_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 4.1 and later
- [Scalance Sc-600](https://www.precursorintelligence.com/product/siemens/scalance_sc-600) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Sc-600 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_sc-600_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.0 and later
- [Scalance W1700](https://www.precursorintelligence.com/product/siemens/scalance_w1700) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance W1700 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_w1700_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.0 and later
- [Scalance W700](https://www.precursorintelligence.com/product/siemens/scalance_w700) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance W700 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_w700_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 6.5 and later
- [Scalance Xb-200](https://www.precursorintelligence.com/product/siemens/scalance_xb-200) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xb-200 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xb-200_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 4.3
- [Scalance Xc-200](https://www.precursorintelligence.com/product/siemens/scalance_xc-200) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xc-200 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xc-200_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 4.3
- [Scalance Xf-200ba](https://www.precursorintelligence.com/product/siemens/scalance_xf-200ba) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xf-200ba Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xf-200ba_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 4.3
- [Scalance Xm-400](https://www.precursorintelligence.com/product/siemens/scalance_xm-400) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xm-400 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xm-400_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 6.4
- [Scalance Xp-200](https://www.precursorintelligence.com/product/siemens/scalance_xp-200) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xp-200 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xp-200_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 4.3
- [Scalance XR-300wg](https://www.precursorintelligence.com/product/siemens/scalance_xr-300wg) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance XR-300wg Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xr-300wg_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 4.3
- [Scalance Xr524-8c](https://www.precursorintelligence.com/product/siemens/scalance_xr524-8c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xr524-8c Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xr524-8c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 6.4
- [Scalance Xr526-8c](https://www.precursorintelligence.com/product/siemens/scalance_xr526-8c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xr526-8c Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xr526-8c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 6.4
- [Scalance Xr528-6m](https://www.precursorintelligence.com/product/siemens/scalance_xr528-6m) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xr528-6m Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xr528-6m_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 6.4
- [Scalance Xr552-12](https://www.precursorintelligence.com/product/siemens/scalance_xr552-12) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Scalance Xr552-12 Firmware](https://www.precursorintelligence.com/product/siemens/scalance_xr552-12_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): before 6.4
- [Secure Backup](https://www.precursorintelligence.com/product/oracle/secure_backup) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): before 18.1.0.1.0
- [Secure Global Desktop](https://www.precursorintelligence.com/product/oracle/secure_global_desktop) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 5.6
- [Simatic Cloud Connect 7](https://www.precursorintelligence.com/product/siemens/simatic_cloud_connect_7) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Cloud Connect 7 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_cloud_connect_7_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 1.1 and later
- [Simatic Cp 1242-7 Gprs V2](https://www.precursorintelligence.com/product/siemens/simatic_cp_1242-7_gprs_v2) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Cp 1242-7 Gprs V2 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_cp_1242-7_gprs_v2_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 3.1 and later
- [Simatic HMI Basic Panels 2nd Generation](https://www.precursorintelligence.com/product/siemens/simatic_hmi_basic_panels_2nd_generation) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic HMI Basic Panels 2nd Generation Firmware](https://www.precursorintelligence.com/product/siemens/simatic_hmi_basic_panels_2nd_generation_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic HMI Comfort Outdoor Panels](https://www.precursorintelligence.com/product/siemens/simatic_hmi_comfort_outdoor_panels) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic HMI Comfort Outdoor Panels Firmware](https://www.precursorintelligence.com/product/siemens/simatic_hmi_comfort_outdoor_panels_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic HMI Ktp Mobile Panels](https://www.precursorintelligence.com/product/siemens/simatic_hmi_ktp_mobile_panels) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic HMI Ktp Mobile Panels Firmware](https://www.precursorintelligence.com/product/siemens/simatic_hmi_ktp_mobile_panels_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Mv500](https://www.precursorintelligence.com/product/siemens/simatic_mv500) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Mv500 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_mv500_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Net Cp 1243-1](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1243-1) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1243-1 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1243-1_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 3.1 and later
- [Simatic Net Cp 1243-8 Irc](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1243-8_irc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1243-8 Irc Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1243-8_irc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 3.1 and later
- [Simatic Net Cp 1542sp-1 Irc](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1542sp-1_irc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1542sp-1 Irc Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1542sp-1_irc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.1 and later
- [Simatic Net Cp 1543-1](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1543-1) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1543-1 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1543-1_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.2 to before 3.0
- [Simatic Net Cp 1543sp-1](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1543sp-1) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1543sp-1 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1543sp-1_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.1 and later
- [Simatic Net Cp 1545-1](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1545-1) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp 1545-1 Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp_1545-1_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 1.0 and later
- [Simatic Net Cp1243-7 Lte Eu](https://www.precursorintelligence.com/product/siemens/simatic_net_cp1243-7_lte_eu) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp1243-7 Lte Eu Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp1243-7_lte_eu_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 3.1 and later
- [Simatic Net Cp1243-7 Lte Us](https://www.precursorintelligence.com/product/siemens/simatic_net_cp1243-7_lte_us) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Net Cp1243-7 Lte Us Firmware](https://www.precursorintelligence.com/product/siemens/simatic_net_cp1243-7_lte_us_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 3.1 and later
- [Simatic Pcs 7 Telecontrol](https://www.precursorintelligence.com/product/siemens/simatic_pcs_7_telecontrol) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Pcs 7 Telecontrol Firmware](https://www.precursorintelligence.com/product/siemens/simatic_pcs_7_telecontrol_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Pcs Neo](https://www.precursorintelligence.com/product/siemens/simatic_pcs_neo) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Pcs Neo Firmware](https://www.precursorintelligence.com/product/siemens/simatic_pcs_neo_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Pdm](https://www.precursorintelligence.com/product/siemens/simatic_pdm) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Pdm Firmware](https://www.precursorintelligence.com/product/siemens/simatic_pdm_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 9.1.0.7 and later
- [Simatic Process Historian Opc Ua Server](https://www.precursorintelligence.com/product/siemens/simatic_process_historian_opc_ua_server) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Process Historian Opc Ua Server Firmware](https://www.precursorintelligence.com/product/siemens/simatic_process_historian_opc_ua_server_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2019 and later
- [Simatic Rf166c](https://www.precursorintelligence.com/product/siemens/simatic_rf166c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf166c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf166c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf185c](https://www.precursorintelligence.com/product/siemens/simatic_rf185c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf185c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf185c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf186c](https://www.precursorintelligence.com/product/siemens/simatic_rf186c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf186c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf186c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf186ci](https://www.precursorintelligence.com/product/siemens/simatic_rf186ci) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf186ci Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf186ci_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf188c](https://www.precursorintelligence.com/product/siemens/simatic_rf188c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf188c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf188c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf188ci](https://www.precursorintelligence.com/product/siemens/simatic_rf188ci) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf188ci Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf188ci_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Rf360r](https://www.precursorintelligence.com/product/siemens/simatic_rf360r) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic Rf360r Firmware](https://www.precursorintelligence.com/product/siemens/simatic_rf360r_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1211c](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1211c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1211c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1211c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1212c](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1212c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1212c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1212c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1212fc](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1212fc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1212fc Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1212fc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1214 Fc](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1214_fc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1214 Fc Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1214_fc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1214c](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1214c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1214c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1214c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1215 Fc](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1215_fc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1215 Fc Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1215_fc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1215c](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1215c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1215c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1215c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic S7-1200 CPU 1217c](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1217c) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Simatic S7-1200 CPU 1217c Firmware](https://www.precursorintelligence.com/product/siemens/simatic_s7-1200_cpu_1217c_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- Simatic S7-1500 CPU 1518-4 Pn/dp Mfp by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- Simatic S7-1500 CPU 1518-4 Pn/dp Mfp Firmware by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Simatic Wincc Runtime Advanced](https://www.precursorintelligence.com/product/siemens/simatic_wincc_runtime_advanced) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): all versions
- [Simatic Wincc Telecontrol](https://www.precursorintelligence.com/product/siemens/simatic_wincc_telecontrol) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): version not specified
- [Sinamics Connect 300](https://www.precursorintelligence.com/product/siemens/sinamics_connect_300) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Sinamics Connect 300 Firmware](https://www.precursorintelligence.com/product/siemens/sinamics_connect_300_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): all versions
- [Sinec Infrastructure Network Services](https://www.precursorintelligence.com/product/siemens/sinec_infrastructure_network_services) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): before 1.0.1.1
- [Sinec Pni](https://www.precursorintelligence.com/product/siemens/sinec_pni) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): version not specified
- [Sinumerik Opc Ua Server](https://www.precursorintelligence.com/product/siemens/sinumerik_opc_ua_server) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): all versions
- [Sma100](https://www.precursorintelligence.com/product/sonicwall/sma100) by [SonicWall](https://www.precursorintelligence.com/vendors/sonicwall) (Hardware): version not specified
- [Sma100 Firmware](https://www.precursorintelligence.com/product/sonicwall/sma100_firmware) by [SonicWall](https://www.precursorintelligence.com/vendors/sonicwall) (Operating system): 10.2.0.0 to before 10.2.1.0-17sv
- [Snapcenter](https://www.precursorintelligence.com/product/netapp/snapcenter) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [SonicOS](https://www.precursorintelligence.com/product/sonicwall/sonicos) by [SonicWall](https://www.precursorintelligence.com/vendors/sonicwall) (Operating system): 7.0.1.0
- [Storagegrid](https://www.precursorintelligence.com/product/netapp/storagegrid) by [Netapp](https://www.precursorintelligence.com/vendors/netapp) (Application): version not specified
- [Tenable.sc](https://www.precursorintelligence.com/product/tenable/tenable.sc) by [Tenable](https://www.precursorintelligence.com/vendors/tenable) (Application): 5.13.0 to 5.17.0
- [Tia Administrator](https://www.precursorintelligence.com/product/siemens/tia_administrator) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Application): all versions
- [Tim 1531 Irc](https://www.precursorintelligence.com/product/siemens/tim_1531_irc) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Hardware): version not specified
- [Tim 1531 Irc Firmware](https://www.precursorintelligence.com/product/siemens/tim_1531_irc_firmware) by [Siemens](https://www.precursorintelligence.com/vendors/siemens) (Operating system): 2.0 to before 2.2
- [Zfs Storage Appliance Kit](https://www.precursorintelligence.com/product/oracle/zfs_storage_appliance_kit) by [Oracle](https://www.precursorintelligence.com/vendors/oracle) (Application): 8.8

## How do I fix CVE-2021-3449?

1. **Check whether you run it.** Compare your versions with the affected products above. Not sure what you run? Precursor Intelligence can work it out from your public website, or you can pick it from a list.
2. **Apply the vendor’s fix.** Install the update named in the vendor’s advisory. We’ve put the advisories and patch notes first in the list.
3. **If you can’t patch today.** Follow any mitigation the vendor publishes, and limit who can reach the affected system from the internet until the update is in.
4. **Keep an eye on it.** Track the product and we tell you as soon as we spot this flaw on the list of exploited flaws, or a jump in its exploit likelihood.

### References

- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf) (Patch, Third-party advisory)
- [oracle.com](https://www.oracle.com//security-alerts/cpujul2021.html) (Patch, Third-party advisory)
- [oracle.com](https://www.oracle.com/security-alerts/cpuApr2021.html) (Patch, Third-party advisory)
- [oracle.com](https://www.oracle.com/security-alerts/cpuapr2022.html) (Patch, Third-party advisory)
- [openssl.org](https://www.openssl.org/news/secadv/20210325.txt) (Vendor advisory)
- [openwall.com](http://www.openwall.com/lists/oss-security/2021/03/27/1) (Mailing list, Third-party advisory)
- [openwall.com](http://www.openwall.com/lists/oss-security/2021/03/27/2) (Mailing list, Third-party advisory)
- [openwall.com](http://www.openwall.com/lists/oss-security/2021/03/28/3) (Mailing list, Third-party advisory)
- [openwall.com](http://www.openwall.com/lists/oss-security/2021/03/28/4) (Mailing list, Third-party advisory)
- [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf) (Third-party advisory)
- [git.openssl.org](https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148)
- [kb.pulsesecure.net](https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845) (Third-party advisory)
- [kc.mcafee.com](https://kc.mcafee.com/corporate/index?page=content&id=SB10356) (Third-party advisory)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html) (Mailing list, Third-party advisory)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/)
- [psirt.global.sonicwall.com](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013) (Third-party advisory)
- [security.freebsd.org](https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc) (Third-party advisory)
- [security.gentoo.org](https://security.gentoo.org/glsa/202103-03) (Third-party advisory)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20210326-0006/) (Third-party advisory)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20210513-0002/) (Third-party advisory)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20240621-0006/)
- [tools.cisco.com](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd) (Third-party advisory)
- [debian.org](https://www.debian.org/security/2021/dsa-4875) (Third-party advisory)
- [oracle.com](https://www.oracle.com/security-alerts/cpujul2022.html) (Third-party advisory)
- [oracle.com](https://www.oracle.com/security-alerts/cpuoct2021.html) (Third-party advisory)
- [tenable.com](https://www.tenable.com/security/tns-2021-05) (Third-party advisory)
- [tenable.com](https://www.tenable.com/security/tns-2021-06) (Third-party advisory)
- [tenable.com](https://www.tenable.com/security/tns-2021-09) (Third-party advisory)
- [tenable.com](https://www.tenable.com/security/tns-2021-10) (Third-party advisory)

## Questions

### What is CVE-2021-3449?

CVE-2021-3449 is a medium-severity flaw in OpenSSL, published on 25 March 2021. It can be attacked from anywhere on the internet without logging in, and nobody has to click anything. If it works, the attacker can take it offline.

### How serious is CVE-2021-3449?

It scores 5.9 out of 10 on the CVSS severity scale, which is medium. Our risk score for CVE-2021-3449 is 49 out of 100, which is Medium. Its action is "Plan remediation". Not confirmed as exploited yet, but serious or likely enough that it should not wait for a quiet month.

### Is CVE-2021-3449 being exploited?

It is not on the list of flaws known to be exploited today. The latest forecast puts the chance of it being used in the next 30 days at 64%. That can change at any time, which is why we keep watching.

### Which versions does CVE-2021-3449 affect?

For OpenSSL: 1.1.1 to before 1.1.1k. The record lists 167 products in all, each with its versions, under "Who is affected" on this page.

### How do I fix CVE-2021-3449?

Install the update the vendor names in its advisory, linked first under "How do I fix" on this page. If you can't patch today, follow the vendor's mitigation and limit who can reach the affected system from the internet.

## Does CVE-2021-3449 affect you?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact