ZeroDay Findings
Sign inSign up

Findings

CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challen…

Published Jul 9, 2024 · updated Oct 15, 2026 · freeradius freeradius

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 9, 2024 · NIST NVD

    Detected

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

  2. Oct 15, 2026 · NIST NVD

    Updated

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Affected

  • cpe broadcom/brocade sannavversion unspecified
  • cpe broadcom/fabric operating systemversion unspecified
  • cpe freeradius/freeradiusversion unspecified
  • cpe sonicwall/sonicosversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2024-3596

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-3596

    30-day exploitation probability 14.9%

    first.org
  • NIST NVDVulnerability recordCVE-2024-3596

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

    nvd.nist.gov

References

CVE-2024-3596 · ZeroDay Findings