CAPEC-697

DHCP is broadcast to the entire Local Area Network (LAN) and does not have any form of authentication by default. Therefore, it is susceptible to spoofing.

An adversary with access to the target LAN can receive DHCP messages; obtaining the topology information required to potentially manipulate other hosts' network configurations.

To improve the likelihood of the DHCP request being serviced by the Rogue server, an adversary can first starve the DHCP pool.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Determine Exsisting DHCP lease] An adversary observes network traffic and waits for an existing DHCP lease to expire on a target machine in the LAN.

      1 technique

      • Adversary observes LAN traffic for DHCP solicitations

2. Experiment

   They probe what they found.

   2. [Capture the DHCP DISCOVER message] The adversary captures "DISCOVER" messages and crafts "OFFER" responses for the identified target MAC address. The success of this attack centers on the capturing of and responding to these "DISCOVER" messages.

      1 technique

      • Adversary captures and responds to DHCP "DISCOVER" messages tailored to the target subnet.

3. Exploit

   They carry out the attack.

   3. [Compromise Network Access and Collect Network Activity] An adversary successfully acts as a rogue DHCP server by redirecting legitimate DHCP requests to itself.

      1 technique

      • Adversary sends repeated DHCP "REQUEST" messages to quickly lease all the addresses within network's DHCP pool and forcing new DHCP requests to be handled by the rogue DHCP server.

Prerequisites

• The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.

Skills required

• Medium skill

  The adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.

Resources required

• The adversary requires access to a machine within the target LAN on a network which does not secure its DHCP traffic through MAC-Forced Forwarding, port security, etc.

Consequences

Mitigations

• Design: MAC-Forced Forwarding

• Implementation: Port Security and DHCP snooping

• Implementation: Network-based Intrusion Detection Systems

Weaknesses it exploits

• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

Recent CVEs with these weaknesses

1. 7.2CVE-2026-1253612026-11-10

   Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification…

2. 7.7CVE-2026-107562026-10-27

   TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with loca…

3. 5.0CVE-2026-1109092026-10-15

   Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code sub…

4. 6.9CVE-2026-1020852026-10-14

   An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact t…

5. 8.2CVE-2026-859252026-10-13

   Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

6. 7.0CVE-2026-702122026-10-13

   Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.

7. 9.0CVE-2026-863452026-10-02

   A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS…

8. 9.1CVE-2026-921732026-09-30

   Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. Tha…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-194 Fake the Source of Data

Can lead to

• CAPEC-158 Sniffing Network Traffic
• CAPEC-94 Adversary in the Middle (AiTM)

Examples

MITRE's words, unchanged: CAPEC-697 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.