CVE-2024-3596 (GCVE-0-2024-3596)

Vulnerability from cvelistv5 – Published: 2024-07-09 12:02 – Updated: 2025-11-04 17:20
VLAI?
Summary
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
Assigner
Impacted products
Vendor Product Version
IETF RFC Affected: 2865
Create a notification for this product.
Credits
Thanks to Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl who researched and reported this vulnerability
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ietf:rfc:2865:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rfc",
            "vendor": "ietf",
            "versions": [
              {
                "status": "affected",
                "version": "2865"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-3596",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T03:55:37.141738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-04T21:05:25.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:52.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20240822-0001/"
          },
          {
            "url": "https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://datatracker.ietf.org/doc/html/rfc2865"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.blastradius.fail/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/09/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/456537"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RFC",
          "vendor": "IETF",
          "versions": [
            {
              "status": "affected",
              "version": "2865"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thanks to Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl who researched and reported this vulnerability"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-328: Use of Weak Hash",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-03T17:29:16.788Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://datatracker.ietf.org/doc/html/rfc2865"
        },
        {
          "url": "https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/"
        },
        {
          "url": "https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf"
        },
        {
          "url": "https://www.blastradius.fail/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/07/09/4"
        },
        {
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014"
        },
        {
          "name": "Siemens Security Advisory by Siemens ProductCERT for  SIPROTEC, SICAM and related product",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-794185.html"
        },
        {
          "name": "Siemens Security Advisory by Siemens ProductCERT to SCALANCE, RUGGEDCOM and related products.",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-723487.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.",
      "x_generator": {
        "engine": "VINCE 3.0.4",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-3596"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2024-3596",
    "datePublished": "2024-07-09T12:02:53.001Z",
    "dateReserved": "2024-04-10T15:09:45.391Z",
    "dateUpdated": "2025-11-04T17:20:52.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.0.27\", \"matchCriteriaId\": \"1C73FF4C-13DE-4050-BD56-447F9382AA4D\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"75B1EDA5-F189-440D-AD0E-C70DD2C0FEE5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"046FB51E-B768-44D3-AEB5-D857145CA840\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1CF61DAA-8295-4407-B125-1714E1565965\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\"}, {\"lang\": \"es\", \"value\": \"El protocolo RADIUS seg\\u00fan RFC 2865 es susceptible a ataques de falsificaci\\u00f3n por parte de un atacante local que puede modificar cualquier respuesta v\\u00e1lida (acceso-aceptaci\\u00f3n, acceso-rechazo o acceso-desaf\\u00edo) a cualquier otra respuesta utilizando un ataque de colisi\\u00f3n de prefijo elegido contra la firma del autenticador de respuesta MD5. .\"}]",
      "id": "CVE-2024-3596",
      "lastModified": "2024-12-30T19:23:20.437",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 6.0}]}",
      "published": "2024-07-09T12:15:20.700",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/09/4\", \"source\": \"cret@cert.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\", \"source\": \"cret@cert.org\", \"tags\": [\"Technical Description\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc2865\", \"source\": \"cret@cert.org\", \"tags\": [\"Technical Description\"]}, {\"url\": \"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\", \"source\": \"cret@cert.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\", \"source\": \"cret@cert.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.blastradius.fail/\", \"source\": \"cret@cert.org\", \"tags\": [\"Technical Description\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/09/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Technical Description\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc2865\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Technical Description\"]}, {\"url\": \"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240822-0001/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.blastradius.fail/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Technical Description\"]}]",
      "sourceIdentifier": "cret@cert.org",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-354\"}, {\"lang\": \"en\", \"value\": \"CWE-924\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-3596\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2024-07-09T12:15:20.700\",\"lastModified\":\"2025-11-04T18:16:31.367\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\"},{\"lang\":\"es\",\"value\":\"El protocolo RADIUS seg\u00fan RFC 2865 es susceptible a ataques de falsificaci\u00f3n por parte de un atacante local que puede modificar cualquier respuesta v\u00e1lida (acceso-aceptaci\u00f3n, acceso-rechazo o acceso-desaf\u00edo) a cualquier otra respuesta utilizando un ataque de colisi\u00f3n de prefijo elegido contra la firma del autenticador de respuesta MD5. .\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":6.0},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-354\"},{\"lang\":\"en\",\"value\":\"CWE-924\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.0.27\",\"matchCriteriaId\":\"1C73FF4C-13DE-4050-BD56-447F9382AA4D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75B1EDA5-F189-440D-AD0E-C70DD2C0FEE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"046FB51E-B768-44D3-AEB5-D857145CA840\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CF61DAA-8295-4407-B125-1714E1565965\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/07/09/4\",\"source\":\"cret@cert.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-723487.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-794185.html\",\"source\":\"cret@cert.org\"},{\"url\":\"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\",\"source\":\"cret@cert.org\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc2865\",\"source\":\"cret@cert.org\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\",\"source\":\"cret@cert.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\",\"source\":\"cret@cert.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.blastradius.fail/\",\"source\":\"cret@cert.org\",\"tags\":[\"Technical Description\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/07/09/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc2865\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240822-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.blastradius.fail/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/456537\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.netapp.com/advisory/ntap-20240822-0001/\"}, {\"url\": \"https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol\"}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc2865\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.blastradius.fail/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/09/4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/456537\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:20:52.225Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3596\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-11T03:55:37.141738Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ietf:rfc:2865:*:*:*:*:*:*:*\"], \"vendor\": \"ietf\", \"product\": \"rfc\", \"versions\": [{\"status\": \"affected\", \"version\": \"2865\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-24T20:18:02.244Z\"}}], \"cna\": {\"title\": \"RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Thanks to Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl who researched and reported this vulnerability\"}], \"affected\": [{\"vendor\": \"IETF\", \"product\": \"RFC\", \"versions\": [{\"status\": \"affected\", \"version\": \"2865\"}]}], \"references\": [{\"url\": \"https://datatracker.ietf.org/doc/html/rfc2865\"}, {\"url\": \"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/\"}, {\"url\": \"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf\"}, {\"url\": \"https://www.blastradius.fail/\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/09/4\"}, {\"url\": \"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-794185.html\", \"name\": \"Siemens Security Advisory by Siemens ProductCERT for  SIPROTEC, SICAM and related product\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-723487.html\", \"name\": \"Siemens Security Advisory by Siemens ProductCERT to SCALANCE, RUGGEDCOM and related products.\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"env\": \"prod\", \"engine\": \"VINCE 3.0.4\", \"origin\": \"https://cveawg.mitre.org/api/cve/CVE-2024-3596\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-328: Use of Weak Hash\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel\"}]}], \"providerMetadata\": {\"orgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"shortName\": \"certcc\", \"dateUpdated\": \"2025-09-03T17:29:16.788Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-3596\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T17:20:52.225Z\", \"dateReserved\": \"2024-04-10T15:09:45.391Z\", \"assignerOrgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"datePublished\": \"2024-07-09T12:02:53.001Z\", \"assignerShortName\": \"certcc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…