361 matches found
CVE-2023-39373
The CVE-2023-39373 entry describes an authentication bypass by capture-replay in Hyundai model 2017 (CWE-294). Affected component is the vehicle’s authentication mechanism; impact is high on integrity but no confidentiality/availability impact reported. Exploitation status is not detailed in the ...
PT-2023-26902 · Hyundai · Hyundai
Name of the Vulnerable Software and Affected Versions: Hyundai model version 2017 Description: The issue is related to an authentication bypass by capture-replay, identified as CWE-294. This allows for unauthorized access. Recommendations: For the Hyundai model version 2017, at the moment, there ...
Mitsubishi Electric MELSEC-F Series Authentication Bypass By Capture-Replay (CVE-2023-2846)
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets. This plugin only works wit...
The vulnerabilities of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET(-L) of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, allow attackers to circumvent security restrictions and reset system settings.
The vulnerability of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET-L of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, stems from the ability to bypass authentication by using capture-replay techniques...
CVE-2023-2846
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets...
Authentication flaw
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets...
CVE-2023-2846
CVE-2023-2846 concerns an authentication bypass by capture-replay in Mitsubishi Electric MELSEC iQ-F Series main modules. Affected products include MELSEC iQ-F Series PLCs (e.g., FX3U, FX3UC, FX3G, FX3GE/FX3GA/FX3S/FX3SA and related Ethernet adapters like FX3U-ENET-ADP/FX3U-ENET(-L)). The root ca...
CVE-2023-2846 Authentication Bypass Vulnerability in MELSEC-F Series main module
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets...
Mitsubishi Electric MELSEC-F Series
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC-F Series Vulnerability: Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...
PT-2023-3413 · Mitsubishi · Melsec Iq-F Series
Name of the Vulnerable Software and Affected Versions: MELSEC iQ-F Series versions FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA Description: The issue is related to an authentication bypass vulnerability using a capture-replay attack on intercepted parameters. This could allow a...
CVE-2023-29158 SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay
SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity...
Omron NJ/NX-series Machine Automation Controllers Authentication Bypass By Capture-Replay (CVE-2022-33208)
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software...
Omron NJ/NX-series Machine Automation Controllers Active Debug Code (CVE-2022-33971)
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow ...
Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay
Overview Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...
JVN#48687031: Qrio Smart Lock Q-SL2 vulnerable to authentication bypass by capture-replay
Qrio Smart Lock Q-SL2 provided by Qrio, inc. contains an authentication bypass by capture-replay vulnerability CWE-294. Impact An attacker may analyze the product's communication data and perform unintended operations under certain conditions. Solution Update the firmware and related products...
Qrio Lock 授权问题漏洞
Qrio Lock is Qrio's smart door lock control software. A security vulnerability exists in Qrio Lock version 2.0.9 and prior versions that stems from an easy bypass of authentication via capture replay, which can be exploited by an attacker to potentially analyze the product's communication data an...
Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)
A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...
Exploit for Improper Input Validation in Microsoft
PoC exploit for CVE-2023-23397, a vulnerability in the Apache HT...
Authentication Bypass by Capture-replay
An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session...