Technical impact
Contrast before version 1.16.0 accepts any signed TEE attestation report that verifies and contains the correct firmware and software measurements, but it does not bind that report to the physical hardware that produced it. This flaw allows an attacker to relay a valid attestation report from a compromised or physically controlled TEE, effectively masquerading as a trusted Contrast Coordinator or workload. By doing so the attacker can bypass Contrast’s attested TLS (aTLS) identity checks, enabling man‑in‑the‑middle attacks, credential theft, or potentially the execution of unauthorized code within the Contrast ecosystem. The weakness is a classic example of Improper Binding of Authentication Credentials to Device (CWE‑295).
Affected Systems
All installations of the edgelesssys Contrast product that use a version older than 1.16.0 are susceptible to this remote attestation relay attack. No specific patch releases are listed for earlier versions, but the vulnerability is mitigated by updating to any release that is version 1.16.0 or newer.
Risk and Exploitability
The CVSS base score of 9.1 indicates a high‑severity vulnerability; the EPSS score is not available, and it is not flagged in CISA’s KEV catalog. An attacker must first intercept network traffic between the Contrast CLI and the Coordinator or between the Coordinator and an attested component, and must also have a TEE device under their physical control to produce or capture a valid attestation report. Once these conditions are met, the attacker can relay the report to impersonate a trusted component, thereby breaking the authentication guarantees that aTLS provides. The exploitation pathway is therefore a combination of network interception and physical access to a TEE, which presents a significant threat to systems that rely on Contrast’s attestation for secure communications.
