Skip to main content

Authentication Bypass by Capture-replay

CVE-2019-11856

Low
3.3/10

Summary

A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • HIGH
  • NONE
  • LOW

CWE-294 - Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References

Advisory Timeline

  • Published