T1557Credential AccessCollection
Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS…
CVEs43
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.11
Reports1
Detections
10 Sigma rules tagged T1557Adversary-in-the-MiddleT155710 general rules
- Suspicious Child Process of Notepad++ Updater - GUP.Exehighexperimental
- Uncommon File Created by Notepad++ Updater Gup.EXEhighexperimental
- Potential Suspicious Activity Using SeCEditmediumtest
- ISATAP Router Address Was Setmediumexperimental
- Notepad++ Updater DNS Query to Uncommon Domainsmediumexperimental
- Cisco BGP Authentication Failureslowtest
- Cisco LDP Authentication Failureslowtest
- Huawei BGP Authentication Failureslowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Adversary-in-the-Middle
43 CVEs, by priority. Each link shows its badge.- CVE-2022-1040Sophos Firewall Authentication Bypass VulnerabilitySophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+4 moreMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%79.9priority
- CVE-2021-36942Microsoft Windows Local Security Authority (LSA) Spoofing VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1557Adversary-in-the-MiddleAI mapping from the description · primary impact66.0%Top 0.73%78.1priority
- CVE-2019-5591Fortinet FortiOS Default Configuration VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitMedium · 6.5T1133External Remote ServicesT1557Adversary-in-the-Middle+1 moreMITRE CTID mapping of the KEV entry · primary impact18.6%Top 2.7%77.0priority
- CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityAI mapping from the description · primary impact98.5%Top 0.08%73.2priority
- CVE-2026-3502TrueConf Client Download of Code Without Integrity Check VulnerabilityTrueConf · ClientKEVPublic exploitHigh · 7.8T1059Command and Scripting InterpreterT1557Adversary-in-the-MiddleAI mapping from the description · how it is exploited5.8%Top 6.8%72.1priority
- CVE-2022-26925Microsoft Windows LSA Spoofing VulnerabilityMicrosoft · WindowsKEVMedium · 5.9T1190Exploit Public-Facing ApplicationT1557Adversary-in-the-MiddleAI mapping from the description · primary impact10.5%Top 4.3%71.3priority
- CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows…AI mapping from the description · how it is exploited93.5%Top 0.16%70.8priority
- CVE-2022-22536SAP Multiple Products HTTP Request Smuggling VulnerabilitySAP · Multiple ProductsKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1557Adversary-in-the-MiddleAI mapping from the description · primary impact97.9%Top 0.09%70.0priority
- CVE-2025-31200Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · follow-on activity20.9%Top 2.4%69.4priority
- CVE-2025-31201Apple Multiple Products Arbitrary Read and Write VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · follow-on activity14.0%Top 3.5%69.2priority
- CVE-2025-15556Notepad++ Download of Code Without Integrity Check VulnerabilityAI mapping from the description · how it is exploited1.7%Top 22%68.8priority
- CVE-2020-11023JQuery Cross-Site Scripting (XSS) VulnerabilityMITRE CTID mapping of the CVE · follow-on activity84.9%Top 0.29%67.2priority
- CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingApache Software Foundation · Apache HTTP ServerMedium · 5.3T1190Exploit Public-Facing ApplicationT1557Adversary-in-the-Middle1 reportAI mapping from the description · primary impact55.9%Top 0.96%28.1priority
- CVE-2019-1943Cisco Small Business Series Switches Open Redirect VulnerabilityCisco · Cisco Small Business 300 Series Managed SwitchesPublic exploitMedium · 4.7T1189Drive-by CompromiseT1557Adversary-in-the-Middle+1 moreMITRE CTID mapping of the CVE · how it is exploited9.7%Top 4.5%27.4priority
- CVE-2020-15093Improper verification of signature threshold in toughMITRE CTID mapping of the CVE · primary impact1.4%Top 28%20.3priority
- CVE-2019-6538Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access ControlMedtronic · Conexus Radio Frequency Telemetry ProtocolCritical · 9.3T1574Hijack Execution FlowT1557Adversary-in-the-Middle+2 moreMITRE CTID mapping of the CVE · primary impact0.9%Top 40%19.8priority
- CVE-2020-11082Cross-Site Scripting in KaminariMITRE CTID mapping of the CVE · follow-on activity1.5%Top 25%19.5priority
- CVE-2019-1715Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) SoftwareMedium · 5.3T1078Valid AccountsT1110Brute Force+2 moreMITRE CTID mapping of the CVE · primary impact1.7%Top 22%19.2priority
- CVE-2020-11030Cross-site scripting (XSS) in Search block in WordPressMITRE CTID mapping of the CVE · follow-on activity1.4%Top 27%19.1priority
- CVE-2019-1941Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco · Cisco Identity Services Engine SoftwareMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity1.3%Top 30%18.2priority
- CVE-2019-1860Cisco Unified Intelligence Center Remote File Injection VulnerabilityCisco · Cisco Unified Intelligence CenterMedium · 5.9T1557Adversary-in-the-MiddleT1005Data from Local SystemMITRE CTID mapping of the CVE · primary impact1.3%Top 30%18.0priority
- CVE-2018-15393Cisco Content Security Management Appliance (SMA) Cross-Site Scripting VulnerabilityCisco · Cisco Content Security Management Appliance (SMA)Medium · 4.8T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity1.2%Top 31%17.2priority
- CVE-2020-11035weak CSRF tokens in GLPIMITRE CTID mapping of the CVE · primary impact0.9%Top 40%17.2priority
- CVE-2020-3121Cisco Small Business Smart and Managed Switches Cross-Site Scripting VulnerabilityCisco · Cisco 550X Series Stackable Managed SwitchesMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity1.1%Top 35%17.2priority
- CVE-2018-14809Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote…MITRE CTID mapping of the CVE · primary impact2.7%Top 14%17.1priority
- CVE-2019-3754Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to…MITRE CTID mapping of the CVE · follow-on activity1.1%Top 34%16.5priority
- CVE-2019-1665Cisco Hyperflex Stored Cross-Site Scripting VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.1%Top 35%16.4priority
- CVE-2020-3137Cisco Email Security Appliance Cross-Site Scripting VulnerabilityCisco · Cisco Email Security Appliance (ESA)Medium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity0.8%Top 42%15.8priority
- CVE-2020-3356Cisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityCisco · Cisco Data Center Network ManagerMedium · 6.1T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%15.6priority
- CVE-2019-1838Cisco Application Policy Infrastructure Controller Web-Based Management Interface Cross-Site Scripting VulnerabilityCisco · Cisco Application Policy Infrastructure Controller (APIC)Medium · 5.4T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%15.2priority
- CVE-2019-15994Cisco Stealthwatch Enterprise Cross-Site Scripting VulnerabilityMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%15.1priority
- CVE-2018-15784DSA-2019-001: Dell Networking OS10 Improper Certificate Validation VulnerabilityMITRE CTID mapping of the CVE · primary impact0.6%Top 51%15.0priority
- CVE-2020-3233Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting VulnerabilityMITRE CTID mapping of the CVE · follow-on activity0.6%Top 50%14.5priority
- CVE-2020-5270Open redirection when using back parameter of PrestaShopMITRE CTID mapping of the CVE · follow-on activity0.8%Top 42%14.4priority
- CVE-2020-5269Reflected XSS on AdminFeatures page of PrestaShopMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%14.2priority
- CVE-2020-5271Reflected XSS with dashboard calendar of PrestaShopMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%14.2priority
- CVE-2020-5264Reflected XSS in security compromised page of PrestaShopMITRE CTID mapping of the CVE · follow-on activity0.8%Top 45%14.1priority
- CVE-2020-5336RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerabilityMITRE CTID mapping of the CVE · follow-on activity0.7%Top 47%13.9priority
- CVE-2018-11087TLS validation errorPivotal · Spring AMQPT1557Adversary-in-the-MiddleMITRE CTID mapping of the CVE · primary impact1.2%Top 31%13.8priority
- CVE-2019-15280Cisco Firepower Management Center Software Stored Cross-Site Scripting VulnerabilityCisco · Cisco Firepower Management CenterMedium · 4.8T1189Drive-by CompromiseT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity0.6%Top 50%13.3priority
- CVE-2020-3349Cisco Data Center Network Manager Cross-Site Scripting VulnerabilitiesCisco · Cisco Data Center Network ManagerMedium · 4.8T1204.001Malicious LinkT1059.007JavaScript+1 moreMITRE CTID mapping of the CVE · follow-on activity0.6%Top 50%13.3priority
- CVE-2018-10610An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application…WECON Technology Co., Ltd · LeviStudioUT1574Hijack Execution FlowT1557Adversary-in-the-Middle+2 moreMITRE CTID mapping of the CVE · primary impact1.1%Top 34%13.2priority
- CVE-2020-5266Stored XSS on back office edit pageMITRE CTID mapping of the CVE · follow-on activity0.6%Top 49%13.2priority