CWE-294 Authentication Bypass by Capture-replay
baseA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (342)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-27348US | critical9.8OT critical | KEV | ||
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11
Users are recommended t… | ||||
| CVE-2023-23397US | critical9.8OT critical | KEV | ||
Microsoft Outlook Elevation of Privilege Vulnerability | ||||
| CVE-2017-3191US | critical9.8OT high | — | ||
D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remot… | ||||
| CVE-2024-3596US | critical9.0OT high | Exploit | ||
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot… | ||||
| CVE-2017-6823US | high8.8OT high | Exploit | ||
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action. | ||||
| CVE-2022-2334US | high7.2OT elevated | Exploit | ||
The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targ… | ||||
| CVE-2022-22806US | critical9.8OT elevated | — | ||
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Prod… | ||||
| CVE-2022-38766US | high8.1OT elevated | Exploit | ||
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack. | ||||
| CVE-2013-2810US | high10.0OT elevated | — | ||
Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attack… | ||||
| CVE-2017-6034US | critical9.8OT elevated | — | ||
An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modb… | ||||
| CVE-2016-5086US | critical9.8OT elevated | — | ||
Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks. | ||||
| CVE-2013-2820US | high10.0OT elevated | — | ||
The Sierra Wireless AirLink Raven X EV-DO gateway 4221_4.0.11.003 and 4228_4.0.11.003 allows remote attackers to reprogram the firmware via a replay attack using UDP ports 17336 an… | ||||
| CVE-2026-73312US | high7.4OT elevated | Exploit | ||
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consum… | ||||
| CVE-2026-73311US | high7.4OT elevated | Exploit | ||
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorizati… | ||||
| CVE-2023-30909US | critical9.8OT elevated | — | ||
A remote authentication bypass issue exists in some
OneView APIs.
| ||||
| CVE-2022-45789US | critical9.8OT elevated | — | ||
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticate… | ||||
| CVE-2021-45327US | critical9.8OT elevated | — | ||
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user ex… | ||||
| CVE-2018-19025US | critical9.8OT elevated | — | ||
In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending ...9A,… | ||||
| CVE-2018-17932US | critical9.8OT elevated | — | ||
JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attackers to replay comman… | ||||
| CVE-2018-7790US | critical9.8OT elevated | — | ||
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allow… | ||||
03
attack patterns (10)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan