{"id":"CVE-2024-3596","title":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack again…","summary":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack again…","severity":"critical","cvss":9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-354","CWE-924","CWE-328","CWE-200"],"vendor":"freeradius","product":"freeradius","affected":["freeradius < 3.0.27","brocade_sannav","fabric_operating_system","sonicos"],"patched":["freeradius 3.0.27"],"published":"2024-07-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:35.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","references":[{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/4","label":"cret@cert.org"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-723487.html","label":"cret@cert.org"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794185.html","label":"cret@cert.org"},{"url":"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","label":"cret@cert.org"},{"url":"https://datatracker.ietf.org/doc/html/rfc2865","label":"cret@cert.org"},{"url":"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","label":"cret@cert.org"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","label":"cret@cert.org"},{"url":"https://www.blastradius.fail/","label":"cret@cert.org"},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://datatracker.ietf.org/doc/html/rfc2865","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240822-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.blastradius.fail/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.kb.cert.org/vuls/id/456537","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-364175.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-723487.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-770770.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794185.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.14859,"epssPercentile":0.96654,"exploits":{"github":1,"githubRepos":["https://github.com/alperenugurlu/CVE-2024-3596-Detector"],"checkedAt":"2026-10-15T03:30:48.741Z"},"exploitAvailable":true,"ingestedAt":"2026-10-15T03:30:12.717Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-07-11T03:55:37.141738Z"},"slug":"CVE-2024-3596","body":"## Overview\n\nRADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\n\n## Affected\n\n- `freeradius < 3.0.27`\n- `brocade_sannav`\n- `fabric_operating_system`\n- `sonicos`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `freeradius 3.0.27`","depth":"abyssal","depthScore":64,"depthScoreParts":{"impact":49.5,"likelihood":3,"exploitation":12,"ransomware":0},"changes":[]}