MITM on key exchange

Attacker substitutes own public keys in unauthenticated DH

categoryCryptographic, hardware and side-channel attacksseverityVery HighdetectabilityHighlabnot yet measured

Example: Logjam

Classification

29 values: 18 imported, 3 derived, 8 machine-classified. What do these mean?

Attack vector	Cryptographic & side-channelNetwork attacksSoftware vulnerabilities
Reach (CVSS)	Adjacent
Attack complexity	High
Privileges required	None
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Severity	Very High
Impact	Confidentiality
Platform	LinuxmacOSNetwork DevicesWindows
Environment	On-premises
Target asset class	Network device
Kill-chain phase (tactic)	CollectionCredential Access

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile ModificationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowWindows Registry Key Modification

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cryptographic, hardware and side-channel attacks' table, line 550 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1557, capec:CAPEC-94, cwe:CWE-322 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-94 Adversary in the Middle (AiTM): CAPEC prerequisites for this pattern
There are two components communicating with each other. | An attacker is able to identify the nature and mechanism of communication between the two target components. | An attacker can eavesdrop on the communication between the target components. | Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition. | The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.
ev-0004 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-322 'Key Exchange without Entity Authentication', a CWE Base-level weakness (CWE 4.20).
Key Exchange without Entity Authentication
ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 9 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)