Back to CVE records
Critical 9.0Published Jul 9, 2024
CVE-2024-3596RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
Updated under an hour ago ()
Does this affect you?
It affects IETF RFC and 58 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
- CVSS
- 9.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-328, CWE-200, CWE-924
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- certcc
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
IETF RFC ietf:rfc (from the name) | 2865 | CNA record |
ietf rfc ietf:rfc | 2865 | CISA ADP |
Siemens CPC80 Central Processing/Communication siemens:cpc80_central_processing_communication (from the name) | before V16.51 | CISA ADP |
Siemens CPCI85 Central Processing/Communication siemens:cpci85_central_processing_communication (from the name) | before V6.20 | CISA ADP |
Siemens POWER METER SICAM Q100 family siemens:power_meter_sicam_q100_family (from the name) | before V2.70 | CISA ADP |
Siemens POWER METER SICAM Q200 family siemens:power_meter_sicam_q200_family (from the name) | before V2.83 | CISA ADP |
Siemens Powerlink IP siemens:powerlink_ip (from the name) | before V4.23 | CISA ADP |
Siemens RUGGEDCOM APE1808 siemens:ruggedcom_ape1808 (from the name) | all versions | CISA ADP |
Siemens SICAM AK 3 siemens:sicam_ak_3 (from the name) | all versions not affected | CISA ADP |
Siemens SICAM BC siemens:sicam_bc (from the name) | all versions not affected | CISA ADP |
Siemens SICAM GridEdge (Classic) siemens:sicam_gridedge_classic (from the name) | all versions not affected | CISA ADP |
Siemens SICAM GridEdge Applications for SICAM 8 Platform siemens:sicam_gridedge_applications_for_sicam_8_platform (from the name) | all versions not affected | CISA ADP |
Siemens SICAM GridPass siemens:sicam_gridpass (from the name) | before V2.50 | CISA ADP |
Siemens SICAM TM siemens:sicam_tm (from the name) | all versions not affected | CISA ADP |
Siemens SICORE Base system siemens:sicore_base_system (from the name) | before V2.20.0 | CISA ADP |
Siemens SIPROTEC 5 - CP200 Devices siemens:siprotec_5_cp200_devices (from the name) | all versions not affected | CISA ADP |
Siemens SIPROTEC 5 6MD84 (CP300) siemens:siprotec_5_6md84_cp300 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 6MD85 (CP300) siemens:siprotec_5_6md85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 6MD86 (CP300) siemens:siprotec_5_6md86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 6MD89 (CP300) siemens:siprotec_5_6md89_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 6MD89 (CP300) V9.6x siemens:siprotec_5_6md89_cp300_v9.6x (from the name) | before V9.68 | CISA ADP |
Siemens SIPROTEC 5 6MU85 (CP300) siemens:siprotec_5_6mu85_cp300 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7KE85 (CP300) siemens:siprotec_5_7ke85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SA82 (CP100) siemens:siprotec_5_7sa82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SA82 (CP150) siemens:siprotec_5_7sa82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SA86 (CP300) siemens:siprotec_5_7sa86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SA87 (CP300) siemens:siprotec_5_7sa87_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SD82 (CP100) siemens:siprotec_5_7sd82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SD82 (CP150) siemens:siprotec_5_7sd82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SD86 (CP300) siemens:siprotec_5_7sd86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SD87 (CP300) siemens:siprotec_5_7sd87_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SJ81 (CP100) siemens:siprotec_5_7sj81_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SJ81 (CP150) siemens:siprotec_5_7sj81_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SJ82 (CP100) siemens:siprotec_5_7sj82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SJ82 (CP150) siemens:siprotec_5_7sj82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SJ85 (CP300) siemens:siprotec_5_7sj85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SJ86 (CP300) siemens:siprotec_5_7sj86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SK82 (CP100) siemens:siprotec_5_7sk82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SK82 (CP150) siemens:siprotec_5_7sk82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SK85 (CP300) siemens:siprotec_5_7sk85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SL82 (CP100) siemens:siprotec_5_7sl82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7SL82 (CP150) siemens:siprotec_5_7sl82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SL86 (CP300) siemens:siprotec_5_7sl86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SL87 (CP300) siemens:siprotec_5_7sl87_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SS85 (CP300) siemens:siprotec_5_7ss85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7ST85 (CP300) siemens:siprotec_5_7st85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7ST85 (CP300) V9.6x siemens:siprotec_5_7st85_cp300_v9.6x (from the name) | before V9.68 | CISA ADP |
Siemens SIPROTEC 5 7ST86 (CP300) siemens:siprotec_5_7st86_cp300 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7ST86 (CP300) V9.8x siemens:siprotec_5_7st86_cp300_v9.8x (from the name) | before V9.83 | CISA ADP |
Siemens SIPROTEC 5 7SX82 (CP150) siemens:siprotec_5_7sx82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SX85 (CP300) siemens:siprotec_5_7sx85_cp300 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7SY82 (CP150) siemens:siprotec_5_7sy82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7UM85 (CP300) siemens:siprotec_5_7um85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7UT82 (CP100) siemens:siprotec_5_7ut82_cp100 (from the name) | from V7.80 before V8.90 | CISA ADP |
Siemens SIPROTEC 5 7UT82 (CP150) siemens:siprotec_5_7ut82_cp150 (from the name) | before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7UT85 (CP300) siemens:siprotec_5_7ut85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7UT86 (CP300) siemens:siprotec_5_7ut86_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7UT87 (CP300) siemens:siprotec_5_7ut87_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7VE85 (CP300) siemens:siprotec_5_7ve85_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
Siemens SIPROTEC 5 7VK87 (CP300) siemens:siprotec_5_7vk87_cp300 (from the name) | from V7.80 before V10.0 | CISA ADP |
References
- https://datatracker.ietf.org/doc/html/rfc2865technical-description
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/technical-description
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdfthird-party-advisory
- https://www.blastradius.fail/technical-description
- http://www.openwall.com/lists/oss-security/2024/07/09/4mailing-list
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-794185.htmlvendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-723487.htmlvendor-advisory
- https://security.netapp.com/advisory/ntap-20240822-0001/third-party-advisory
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocolthird-party-advisory
- https://www.kb.cert.org/vuls/id/456537
- https://cert-portal.siemens.com/productcert/html/ssa-364175.html
- https://cert-portal.siemens.com/productcert/html/ssa-770770.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.