Weakness (CWE)
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
More detail
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
How to prevent it (2 mitigations)
-
Architecture and Design
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
-
Architecture and Design
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Source: MITRE CWE-294
109 results · Clear filters · Feed
-
High 7.4
Hyundai car CWE-294: Authentication Bypass by Capture-replay
A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
-
High 7.5
Authentication Bypass Vulnerability in MELSEC-F Series main module
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially cr…
-
High 7.5
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access …
-
High 7.5
Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a c…
-
High 7.5
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full acce…
-
High 7.5
Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code repla…
-
High 7.3
Authentication Bypass by Capture-replay in thorsten/phpmyfaq
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
High 8.1
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modb…
-
High 8.1CVE-2022-38766 Public exploit
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for …
-
High 7.5
Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to a…
-
High 7.5
Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire cre…
-
High 7.5
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.
-
High 7.5
The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services…
-
High 8.1
TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authen…
-
High 8.1
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to i…
-
High 7.5
django-mfa2 vulnerable to MFA Replay attack
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
-
High 8.2
VelaUX APIServer vulnerable to Authentication Bypass by Capture-replay
KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to gener…
-
High 7.5
Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.…
-
High 7.5
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challeng…
-
High 8.8
SaltStack Salt Authentication Bypass by Capture-replay
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …
-
High 7.5
Apache Spark Key Negotiation Vulnerability
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an …
-
High 8.1
Multi-Factor Authentication issue in Laravel Fortify
Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
-
High 8.1
AUVESY Versiondog
The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specific .exe is not restarted often, it is possible to access the needed handshake packets between admin/client connections. Using the SYSDBA per…
-
High 8.6
KT-1 Capture-replay
The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
-
High 7.5
Authentication bypass by capture-replay in github.com/cosmos/ethermint
Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still val…
-
High 7.5
Authentication bypass by capture-replay in github.com/cosmos/ethermint
Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
-
High 8.2
Missing Token Replay Detection
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign O…
-
High 8.1
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between …
-
High 8.1
LinOTP replay vulnerability with auto resynchronization enabled for TOTP token
KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).