Back
CVE-2024-3596
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
Critical9.0EPSS 14.9%
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Critical9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 14.9% · top 3.3% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.0.
Weakness
- CWE-328: Use of Weak Hash
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
- CWE-354 (opens in a new tab)All about CWE-354 and its CVEs
- CWE-924 (opens in a new tab)All about CWE-924 and its CVEs
Affected products
References (13)
- https://datatracker.ietf.org/doc/html/rfc2865 (opens in a new tab)x_transferred
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ (opens in a new tab)x_transferred
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf (opens in a new tab)x_transferred
- https://www.blastradius.fail/ (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/09/4 (opens in a new tab)x_transferred
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 (opens in a new tab)x_transferred
- Siemens Security Advisory by Siemens ProductCERT for SIPROTEC, SICAM and related product (opens in a new tab)vendor-advisory
- Siemens Security Advisory by Siemens ProductCERT to SCALANCE, RUGGEDCOM and related products. (opens in a new tab)vendor-advisory
- https://security.netapp.com/advisory/ntap-20240822-0001/ (opens in a new tab)
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol (opens in a new tab)
- https://www.kb.cert.org/vuls/id/456537 (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-364175.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-770770.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-3596)Record last updated .