What’s Vulnerable › Vulnerabilities

CVE-2024-3596: RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-09 · updated 2026-10-15
• Weakness: CWE-354

Description

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Affected products

• Brocade SANnav: all versions
• Brocade Fabric OS: all versions
• freeradius: before 3.0.27 — fixed in 3.0.27
• SonicWall SonicOS: all versions

How to fix

Upgrade to a fixed version: freeradius 3.0.27. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/07/09/4
• https://cert-portal.siemens.com/productcert/html/ssa-723487.html
• https://cert-portal.siemens.com/productcert/html/ssa-794185.html
• https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
• https://datatracker.ietf.org/doc/html/rfc2865
• https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014
• https://www.blastradius.fail/
• http://www.openwall.com/lists/oss-security/2024/07/09/4
• https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
• https://datatracker.ietf.org/doc/html/rfc2865
• https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf

Get alerted when CVE-2024-3596 or the next vulnerability affects your stack