CVE-2021-27289

A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network.

• CWE-294

• https://github.com/TheMalwareGuardian/CVE-2021-27289
• https://packetstormsecurity.com/files/160331/Ksix-Zigbee-Devices-Playback-Protection-Bypass.html
• https://www.exploit-db.com/exploits/49169
• https://www.youtube.com/watch?v=5IFUpRKEioA
• https://www.youtube.com/watch?v=XFOy3wSlC9Q
• https://www.youtube.com/watch?v=yc9IEt5IMmA

Published

Apr 15, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27277This vulnerability allows local attackers to escalate privil…7.8
• CVE-2021-27278This vulnerability allows local attackers to escalate privil…8.2
• CVE-2021-27279MyBB before 1.8.25 allows stored XSS via nested [email] tags…5.4
• CVE-2021-27280OS Command injection vulnerability in mblog 3.5.0 allows att…7.8
• CVE-2021-27285An issue was discovered in Inspur ClusterEngine v4.0 that al…8.4
• CVE-2021-27288Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows rem…6.1
• CVE-2021-27290ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a reg…7.5
• CVE-2021-27291In pygments 1.1+, fixed in 2.7.4, the lexers used to parse p…7.5
• CVE-2021-27292ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expr…7.5
• CVE-2021-27293RestSharp < 106.11.8-alpha.0.13 uses a regular expression wh…7.5
• CVE-2021-27294Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-27306An improper access control vulnerability in the JWT plugin i…7.5