Weakness (CWE)
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
More detail
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
How to prevent it (2 mitigations)
-
Architecture and Design
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
-
Architecture and Design
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Source: MITRE CWE-294
265 results · Feed
-
Critical 9.1CVE-2021-27289 Public exploit
A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v…
-
High 7.6
Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028
Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01.
-
High 7.1
SMB forced authentication vulnerability in Sage 200 Spain
SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a se…
-
Critical 9.1
Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attack…
-
High 8.8
Changing Information Technology CGFIDO - Authentication Bypass
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the…
-
Medium 5.4
Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low p…
-
High 7.6
Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerabilit…
-
High 7.8
In the development options section of the Settings app, there is a possible authentication bypass due to a missing perm…
-
High 7.7
A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform…
-
High 7.5
There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated a…
-
High 8.8
IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.
-
Medium 4.2CVE-2024-39081 Public exploit
An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communica…
-
High 8.8
AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay
The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this sessi…
-
Medium 6.1
OPA SMB Force-Authentication
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI…
-
High 8.2
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging suppo…
-
Medium 5.3CVE-2024-45244 Public exploit
Hyperledger Fabric does not verify request has a timestamp within the expected time window
Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.
-
High 8.4
An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versio…
-
Medium 5.4
SAML Replay in Akana
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed.
-
Critical 9.8
D-Link - CWE-294: Authentication Bypass by Capture-replay
D-Link - CWE-294: Authentication Bypass by Capture-replay
-
Medium 6.8
Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.
-
High 7.1
Auth Bypass in Quick Share
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set…
-
High 8.7
Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
-
High 7.1
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker…
-
Critical 9.2
Replay Attack in KNX Secure Devices
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
-
High 8.8
Veeam Backup Enterprise Manager allows account takeover via NTLM relay.
-
High 7.2
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
-
Critical 9.8
An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and acces…
-
Medium 4.8
@workos-inc/authkit-nextjs session replay vulnerability
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
-
Critical 9.8CVE-2023-49231 EPSS 43%
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to …
-
Medium 5.9
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200…
-
High 8.8
The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing…
-
Medium 5.3
The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for…
-
Unscored —
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EX…
-
Medium 6.8
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Application…
-
Medium 5.4
Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replay
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.
-
High 7.5
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. Th…
-
Critical 9.8
A remote authentication bypass issue exists in some OneView APIs.
-
High 7.4
Hyundai car CWE-294: Authentication Bypass by Capture-replay
A Hyundai model (2017) - CWE-294: Authentication Bypass by Capture-replay.
-
Unscored —
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerabil…
-
High 7.5
Authentication Bypass Vulnerability in MELSEC-F Series main module
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially cr…