Weakness (CWE)
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
More detail
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
How to prevent it (2 mitigations)
-
Architecture and Design
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
-
Architecture and Design
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Source: MITRE CWE-294
265 results · Feed
-
High 8.6
KT-1 Capture-replay
The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
-
High 7.5
Authentication bypass by capture-replay in github.com/cosmos/ethermint
Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still val…
-
High 7.5
Authentication bypass by capture-replay in github.com/cosmos/ethermint
Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
-
Unscored —
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump an…
-
Unscored —
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redire…
-
Unscored —
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not v…
-
Unscored —
JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and …
-
Unscored —
In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed o…
-
Unscored —
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All version…
-
Medium 6.8
Authentication bypass in Bareos
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay th…
-
Medium 5.8
Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra
In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique ide…
-
High 8.2
Missing Token Replay Detection
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign O…
-
Unscored —
In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed b…
-
High 8.1
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between …
-
Unscored —
Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products…
-
High 8.1
LinOTP replay vulnerability with auto resynchronization enabled for TOTP token
KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).
-
Unscored —
Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can l…
-
Unscored —
SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.
-
Unscored —
All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and …
-
Critical 9.8
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all …
-
Medium 5.3
Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote c…
-
Unscored —
It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay atta…
-
Unscored —
In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and …
-
Unscored —CVE-2017-3191 EPSS 63%
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the r…
-
Critical 9.8
Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay
An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run,…