Lets say there is mutual authentication between a client which connects to a server on an otherwise unsecured TCP channel. Both parties create a random challenge and the other side answers with a keyd-hash, based on a pre-shared symmetric key.
$$C\rightarrow open \,\, connection \rightarrow S$$ $$C\rightarrow challenge_C \rightarrow S$$ $$C\leftarrow challenge_S \leftarrow S$$
$$C\rightarrow H_K(challenge_S) \rightarrow S$$ $$C\leftarrow H_K(challenge_C) \leftarrow S$$
$$C \leftarrow authenticated \rightarrow S$$
However, an adversary "man-in-the-middle" could listen on the network by whatever means. Whenever a client C is going to establish a TCP connection to the server, MitM could at the same moment establish another adversary client session C' and inject all communication he listens between C and S into the session between C' and S, so C' gets authenticated against S.
It seems too simple - so where is my mistake?