CVE-2024-3596
Cisco RADIUS MD5 Forgery
Description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
INFO
Published Date :
July 9, 2024, 12:15 p.m.
Last Modified :
March 18, 2025, 4:15 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
6.0
Exploitability Score :
2.2
Public PoC/Exploit Available at Github
CVE-2024-3596 has a 2 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2024-3596
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-3596.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-3596 vulnerability anywhere in the article.
-
Cyber Security News
Pegasus Spyware Used Widely to Target Individuals in Private Industry & Finance Sectors
Pegasus spyware, once considered a tool for targeting journalists and activists—is now being deployed against executives in the private sector, including finance, real estate, and logistics. In a Dece ... Read more
-
tripwire.com
Tripwire Patch Priority Index for July 2024
Tripwire's July 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft.First on the list are patches for Microsoft Office and Outlook that resolve remote code executio ... Read more
-
europa.eu
Cyber Security Brief 24-08 - July 2024
Cyber Brief (July 2024)August 1, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 252 open source reports for this Cyber Security Brief1.Cyber policy and law enforcement efforts in Europe have ... Read more
-
Cyber Security News
RADIUS Protocol Vulnerability Impacted Multiple Cisco Products
A critical vulnerability in the Remote Authentication Dial-In User Service (RADIUS) protocol has been disclosed, affecting multiple Cisco products. The vulnerability, CVE-2024-3596, allows an on-path ... Read more
-
The Cloudflare Blog
RADIUS/UDP vulnerable to improved MD5 collision attack
2024-07-0917 min readThe MD5 cryptographic hash function was first broken in 2004, when researchers demonstrated the first MD5 collision, namely two different messages X1 and X2 where MD5(X1) = MD5 (X ... Read more
The following table lists the changes that have been made to the
CVE-2024-3596 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 18, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-200 Added CWE CWE-328 Added CWE CWE-354 Added CWE CWE-924 -
Initial Analysis by [email protected]
Dec. 30, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Added CWE NIST CWE-354 Added CWE NIST CWE-924 Added CPE Configuration OR *cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:* *cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:* versions up to (excluding) 3.0.27 Added CPE Configuration OR *cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:* Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/09/4 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List Changed Reference Type http://www.openwall.com/lists/oss-security/2024/07/09/4 No Types Assigned http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List Changed Reference Type https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ No Types Assigned https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description Changed Reference Type https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ No Types Assigned https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description Changed Reference Type https://datatracker.ietf.org/doc/html/rfc2865 No Types Assigned https://datatracker.ietf.org/doc/html/rfc2865 Technical Description Changed Reference Type https://datatracker.ietf.org/doc/html/rfc2865 No Types Assigned https://datatracker.ietf.org/doc/html/rfc2865 Technical Description Changed Reference Type https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf No Types Assigned https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory Changed Reference Type https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf No Types Assigned https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory Changed Reference Type https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 No Types Assigned https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory Changed Reference Type https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 No Types Assigned https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory Changed Reference Type https://security.netapp.com/advisory/ntap-20240822-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20240822-0001/ Third Party Advisory Changed Reference Type https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol No Types Assigned https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol Third Party Advisory Changed Reference Type https://www.blastradius.fail/ No Types Assigned https://www.blastradius.fail/ Technical Description Changed Reference Type https://www.blastradius.fail/ No Types Assigned https://www.blastradius.fail/ Technical Description -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2024/07/09/4 Added Reference https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Added Reference https://datatracker.ietf.org/doc/html/rfc2865 Added Reference https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Added Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Added Reference https://security.netapp.com/advisory/ntap-20240822-0001/ Added Reference https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol Added Reference https://www.blastradius.fail/ -
CVE Modified by [email protected]
Jul. 23, 2024
Action Type Old Value New Value Added Reference CERT/CC https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 [No types assigned] -
CVE Modified by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Added Reference CERT/CC http://www.openwall.com/lists/oss-security/2024/07/09/4 [No types assigned] -
CVE Modified by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Removed Reference CERT/CC https://www.kb.cert.org/vuls/id/456537 -
CVE Modified by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Added Reference CERT/CC https://www.kb.cert.org/vuls/id/456537 [No types assigned] -
CVE Received by [email protected]
Jul. 09, 2024
Action Type Old Value New Value Added Description RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Added Reference CERT/CC https://datatracker.ietf.org/doc/html/rfc2865 [No types assigned] Added Reference CERT/CC https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ [No types assigned] Added Reference CERT/CC https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf [No types assigned] Added Reference CERT/CC https://www.blastradius.fail/ [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-3596 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-3596
weaknesses.