The product implements an authentication technique, but it skips a step that weakens the technique.
Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
Threat Mapped score: 1.8
Industry: Finiancial
Threat priority: P4 - Informational (Low)
CVE: CVE-2004-2163
Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
CVE: CVE-2005-3327
Chain: Authentication bypass by skipping the first startup step as required by the protocol.
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
N/A