CVE-2024-3596
Critical
Description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Freeradius
PublishedJul 9, 2024
First seenJul 9, 2024
How to fix
Update
- freeradius freeradius3.0.27 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freeradius freeradius | v < 3.0.27 | 3.0.27 |
| broadcom brocade_sannav | No range specified | — |
| broadcom fabric_operating_system | No range specified | — |
| sonicwall sonicos | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.