---
id: CVE-2024-3596
title: >-
  RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local
  attacker who can modify any valid Response (Access-Accept, Access-Reject, or
  Access-Challenge) to any other response using a chosen-prefix collision attack
  again…
summary: >-
  RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local
  attacker who can modify any valid Response (Access-Accept, Access-Reject, or
  Access-Challenge) to any other response using a chosen-prefix collision attack
  again…
severity: critical
cvss: 9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-354
  - CWE-924
  - CWE-328
  - CWE-200
vendor: freeradius
product: freeradius
affected:
  - freeradius < 3.0.27
  - brocade_sannav
  - fabric_operating_system
  - sonicos
patched:
  - freeradius 3.0.27
published: '2024-07-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:35.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3596'
references:
  - url: 'http://www.openwall.com/lists/oss-security/2024/07/09/4'
    label: cret@cert.org
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-723487.html'
    label: cret@cert.org
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794185.html'
    label: cret@cert.org
  - url: 'https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/'
    label: cret@cert.org
  - url: 'https://datatracker.ietf.org/doc/html/rfc2865'
    label: cret@cert.org
  - url: 'https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf'
    label: cret@cert.org
  - url: 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014'
    label: cret@cert.org
  - url: 'https://www.blastradius.fail/'
    label: cret@cert.org
  - url: 'http://www.openwall.com/lists/oss-security/2024/07/09/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://datatracker.ietf.org/doc/html/rfc2865'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240822-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.blastradius.fail/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/456537'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-364175.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-723487.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-770770.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794185.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.14859
epssPercentile: 0.96654
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/alperenugurlu/CVE-2024-3596-Detector'
  checkedAt: '2026-10-15T03:30:48.741Z'
exploitAvailable: true
ingestedAt: '2026-10-15T03:30:12.717Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-07-11T03:55:37.141738Z'
---

## Overview

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

## Affected

- `freeradius < 3.0.27`
- `brocade_sannav`
- `fabric_operating_system`
- `sonicos`

## Remediation

Upgrade past the affected range:

- `freeradius 3.0.27`