CVE-2024-3596

CVSS 3.1: 9.0 critical
EPSS: 15%p96
Published: Jul 9, 2024 · Jul 9, 2024
Modified: Oct 15, 2026

Analyze CVE-2024-3596 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Vendors: freeradius broadcom sonicwall

Products: freeradius, brocade sannav, fabric operating system, sonicos

Weakness: CWE-354, CWE-924

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (14.9%)

In the news

6 stories

Week in review: RADIUS protocol critical vuln, Microsoft 0-day exploited for a year, AT&T breach

Help Net SecurityJul 14, 00:00 UTC · Jul 14, 2024RansomwareCVE-2024-3596 CVE-2024-381121 · 1 read

RADIUS Protocol Vulnerability Exposes Networks to MitM Attacks

The Hacker NewsJul 10, 03:02 UTC · Jul 10, 2024VulnerabilityExploitedCVE-2024-35962 · 1 read

Critical vulnerability in the RADIUS protocol leaves networking equipment open to attack

Help Net SecurityJul 9, 00:00 UTC · Jul 9, 2024VulnerabilityCVE-2024-35962 · 1 read

Description · NVD

In the news

Week in review: RADIUS protocol critical vuln, Microsoft 0-day exploited for a year, AT&T breach

Palo Alto Networks fixed a critical bug in the Expedition tool

Palo Alto Networks Patches Critical Flaw in Expedition Migration Tool

Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited

RADIUS Protocol Vulnerability Exposes Networks to MitM Attacks

Critical vulnerability in the RADIUS protocol leaves networking equipment open to attack