CVE-2021-27289

A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/TheMalwareGuardian/CVE-2021-27289
https://packetstormsecurity.com/files/160331/Ksix-Zigbee-Devices-Playback-Protection-Bypass.html
https://www.exploit-db.com/exploits/49169
https://www.youtube.com/watch?v=5IFUpRKEioA
https://www.youtube.com/watch?v=XFOy3wSlC9Q
https://www.youtube.com/watch?v=yc9IEt5IMmA

Configurations

No configuration.

History

No history.

Information

Published : 2025-04-15 18:15

Updated : 2025-04-16 15:15

NVD link : CVE-2021-27289

Mitre link : CVE-2021-27289

CVE.ORG link : CVE-2021-27289

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2021-27289", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-04-15T18:15:41.850", "references": [{"url": "https://github.com/TheMalwareGuardian/CVE-2021-27289", "source": "[email protected]"}, {"url": "https://packetstormsecurity.com/files/160331/Ksix-Zigbee-Devices-Playback-Protection-Bypass.html", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/49169", "source": "[email protected]"}, {"url": "https://www.youtube.com/watch?v=5IFUpRKEioA", "source": "[email protected]"}, {"url": "https://www.youtube.com/watch?v=XFOy3wSlC9Q", "source": "[email protected]"}, {"url": "https://www.youtube.com/watch?v=yc9IEt5IMmA", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de ataque de repetici\u00f3n en Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), donde el mecanismo antirreproducci\u00f3n de Zigbee, basado en el campo contador de tramas, est\u00e1 implementado incorrectamente. Como resultado, un atacante dentro del alcance inal\u00e1mbrico puede reenviar paquetes capturados con un n\u00famero de secuencia mayor, que los dispositivos aceptan incorrectamente como mensajes leg\u00edtimos. Esto permite inyectar comandos falsificados sin autenticaci\u00f3n, lo que genera alertas falsas y enga\u00f1a al usuario mediante notificaciones en la aplicaci\u00f3n m\u00f3vil utilizada para monitorear la red."}], "lastModified": "2025-04-16T15:15:46.403", "sourceIdentifier": "[email protected]"}