cve.bz

CWE-294: Authentication Bypass by Capture-replay, page 6

Filter

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

What the weakness is: CWE-294 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 10
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-701 Browser in the Middle (BiTM) Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-294, as MITRE names them. Credits.

Ask an AI about CWE-294

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-294: Authentication Bypass by Capture-replay and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/294.html and https://cve.bz/cve/cwe/294?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2021-27662EPSS 0.8%

    The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01

  2. 7.1CVE-2021-26824EPSS 0.4%

    DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentication and access all features and data on the USB.

  3. 5.4CVE-2020-23178EPSS 0.5%

    An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.

  4. 7.5CVE-2021-31958EPSS 2.6%

    Windows NTLM Elevation of Privilege Vulnerability

  5. 6.5CVE-2020-28713EPSS 1.4%

    Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification …

  6. 8.1CVE-2021-27572EPSS 3.2%

    An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbitrary code via crafted UDP packets even when passwords are set.

  7. 5.9CVE-2021-22267EPSS 1.4%

    Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0952L01^AAH through T0952L01^AAR, T0986L01 through T0986L01^AAF, T0665L01^AAP, and T0662L01^AAP (L) …

  8. 7.5CVE-2021-25835EPSS 1.3%

    Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in e…

  9. 7.5CVE-2021-25834EPSS 1.2%

    Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.

  10. 5.7CVE-2020-27269EPSS 0.5%

    In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications lacks replay protection measures, which allows unauthenticated, physic…

  11. 6.5CVE-2020-26172EPSS 0.7%

    Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.

  12. 9.8CVE-2020-35551EPSS 0.4%

    An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-change attacks because an unauthorized RPMB write operation can be replayed, a relate…

  13. 4.9CVE-2020-14302EPSS 1.0%

    A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allow…

  14. 8.8CVE-2020-25660EPSS 1.0%

    A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with acc…

  15. 6.8CVE-2020-13799EPSS 0.3%

    Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol…

  16. 6.8CVE-2020-12355EPSS 0.4%

    Authentication bypass by capture-replay in RPMB protocol message authentication subsystem in Intel(R) TXE versions before 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

  17. 9.8CVE-2018-19025EPSS 1.5%

    In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.).

  18. 9.8CVE-2018-17932EPSS 1.5%

    JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attackers to replay commands, control the device, view commands, or cause the device …

  19. 8.1CVE-2020-27157EPSS 1.0%

    Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server. An unauthenticated user could login to the application and gain access to the …

  20. 5.9CVE-2020-24722EPSS 2.5%

    An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflip…

  21. 3.8CVE-2019-11856EPSS 1.0%

    A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.

  22. 8.8CVE-2020-15688EPSS 4.0%

    The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to prot…

  23. 8.8CVE-2020-10045EPSS 1.1%

    A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An error in the challenge-response procedure could allow an attacker to replay authentication traffic and ga…

  24. 6.8CVE-2020-4042EPSS 1.0%

    Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious …

  25. 5.9CVE-2020-9438EPSS 0.7%

    Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker was previously authorized. In other words, door-access revocation is mishandled.

  26. 5.4CVE-2020-12692EPSS 0.7%

    An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an …

  27. 5.3CVE-2020-5300EPSS 1.0%

    In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion …

  28. 6.8CVE-2020-5261EPSS 1.5%

    Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measu…

  29. 9.1CVE-2020-6972EPSS 1.3%

    In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser.

  30. 6.5CVE-2019-20626EPSS 0.8%

    The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack.

  31. 8.6CVE-2020-10185EPSS 1.7%

    The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default con…

  32. 5.9CVE-2013-1351EPSS 2.0%

    Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password.

  33. 8.1CVE-2019-13533EPSS 0.9%

    In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.

  34. 7.5CVE-2019-12393EPSS 1.1%

    Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.

  35. 9.8CVE-2019-18226EPSS 1.4%

    Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and recorders have a potential replay attack vulnerability as a weak authentication method is retained…

  36. 8.1CVE-2019-12887EPSS 1.2%

    KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).

  37. 3.7CVE-2019-11334EPSS 1.6%

    An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources (that are not otherwise accessible without proper authentication) via capture-re…

  38. 5.7CVE-2019-9158EPSS 1.0%

    Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.

  39. 4.2CVE-2019-5307EPSS 0.3%

    Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), are exposed to a message replay vulnerability. For the sake of better co…

  40. 7.5CVE-2019-3915EPSS 0.6%

    Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthenticated attacker with adjacent network access to intercept and replay login requests to gain acces…

  41. 8.1CVE-2018-15498EPSS 1.2%

    YSoft SafeQ Server 6 allows a replay attack.

  42. 9.1CVE-2019-9659EPSS 1.3%

    The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by Chuango branded products, and non-Chuango …

  43. 8.8CVE-2018-19023EPSS 0.8%

    Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent…

  44. 7.5CVE-2018-7356EPSS 0.7%

    All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections.

  45. 9.1CVE-2018-17903EPSS 1.6%

    SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.

  46. 8.1CVE-2018-17935EPSS 0.7%

    All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the con…

  47. 7.5CVE-2018-13789EPSS 1.2%

    An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SMB servers.

  48. 7.5CVE-2018-17176EPSS 1.0%

    A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be replayed to /bin/webserver on port 8081. The…

  49. 5.3CVE-2018-16242EPSS 0.7%

    oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.

  50. 9.8CVE-2018-7790EPSS 2.4%

    An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If…