cve.bz

CWE-294: Authentication Bypass by Capture-replay, page 7

Filter

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

What the weakness is: CWE-294 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 10
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-701 Browser in the Middle (BiTM) Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-294, as MITRE names them. Credits.

Ask an AI about CWE-294

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-294: Authentication Bypass by Capture-replay and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/294.html and https://cve.bz/cve/cwe/294?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2018-14781EPSS 0.7%

    Medtronic MiniMed MMT devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmission…

  2. 7.5CVE-2018-1128EPSS 1.4%

    It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerabilit…

  3. 8.1CVE-2017-5251EPSS 0.5%

    In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted.

  4. 9.8CVE-2017-3191EPSS 63%

    D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in …

  5. 8.8CVE-2017-11786EPSS 9.4%

    Skype for Business in Microsoft Lync 2013 SP1 and Skype for Business 2016 allows an attacker to steal an authentication hash that can be reused elsewhere, due to how Skype for Business handles authentication requests, aka "Skype for Busine…

  6. 9.8CVE-2017-6034EPSS 5.6%

    An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the foll…

  7. 8.8CVE-2017-6823ExploitEPSS 8.0%

    Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.

  8. –CVE-2002-0054EPSS 22%

    SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH comm…