CVE Intelligence
Skip to main content
CRITICALpublic exploit

CVE-2024-3596

CVE-2024-3596 — RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Published Updated Sources: cvelistV5, certcc

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Exploit code

public exploit, none observed

EPSS

15%

chance of exploitation in 30 days

Affects

ietf

475 products listed

CVSS base

9

CRITICAL

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

No

can an attacker script all four kill-chain steps

Technical impact

Total

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

ietfsiemens

Products (475)

rfccpc80 central processing communicationcpci85 central processing communicationpower meter sicam q100 familypower meter sicam q200 familypowerlink ipruggedcom ape1808ruggedcom crossbowruggedcom i800ruggedcom i800ncruggedcom i801ruggedcom i801ncruggedcom i802ruggedcom i802ncruggedcom i803ruggedcom i803ncruggedcom m2100ruggedcom m2100ncruggedcom m2200ruggedcom m2200ncruggedcom m969ruggedcom m969ncruggedcom rm1224 lte 4g euruggedcom rm1224 lte 4g namruggedcom rmc30ruggedcom rmc30ncruggedcom rmc8388 v4 xruggedcom rmc8388 v5 xruggedcom rmc8388nc v4 xruggedcom rmc8388nc v5 xruggedcom rox mx5000ruggedcom rox mx5000reruggedcom rox rx1400ruggedcom rox rx1500ruggedcom rox rx1501ruggedcom rox rx1510ruggedcom rox rx1511ruggedcom rox rx1512ruggedcom rox rx1524ruggedcom rox rx1536ruggedcom rox rx5000ruggedcom rp110ruggedcom rp110ncruggedcom rs1600ruggedcom rs1600fruggedcom rs1600fncruggedcom rs1600ncruggedcom rs1600truggedcom rs1600tncruggedcom rs400ruggedcom rs400ncruggedcom rs401ruggedcom rs401ncruggedcom rs416ruggedcom rs416ncruggedcom rs416ncv2 v4 xruggedcom rs416ncv2 v5 xruggedcom rs416pruggedcom rs416pncruggedcom rs416pncv2 v4 xruggedcom rs416pncv2 v5 xruggedcom rs416pv2 v4 xruggedcom rs416pv2 v5 xruggedcom rs416v2 v4 xruggedcom rs416v2 v5 xruggedcom rs8000ruggedcom rs8000aruggedcom rs8000ancruggedcom rs8000hruggedcom rs8000hncruggedcom rs8000ncruggedcom rs8000truggedcom rs8000tncruggedcom rs900ruggedcom rs900 32m v4 xruggedcom rs900 32m v5 xruggedcom rs900gruggedcom rs900g 32m v4 xruggedcom rs900g 32m v5 xruggedcom rs900gncruggedcom rs900gnc 32m v4 xruggedcom rs900gnc 32m v5 xruggedcom rs900gpruggedcom rs900gpncruggedcom rs900lruggedcom rs900lncruggedcom rs900m gets c01ruggedcom rs900m gets xxruggedcom rs900m stnd c01ruggedcom rs900m stnd xxruggedcom rs900mnc gets c01ruggedcom rs900mnc gets xxruggedcom rs900mnc stnd xxruggedcom rs900mnc stnd xx c01ruggedcom rs900ncruggedcom rs900nc 32m v4 xruggedcom rs900nc 32m v5 xruggedcom rs900wruggedcom rs910ruggedcom rs910lruggedcom rs910lncruggedcom rs910ncruggedcom rs910wruggedcom rs920lruggedcom rs920lncruggedcom rs920wruggedcom rs930lruggedcom rs930lncruggedcom rs930wruggedcom rs940gruggedcom rs940gncruggedcom rs969ruggedcom rs969ncruggedcom rsg2100ruggedcom rsg2100 32m v4 xruggedcom rsg2100 32m v5 xruggedcom rsg2100ncruggedcom rsg2100nc 32m v4 xruggedcom rsg2100nc 32m v5 xruggedcom rsg2100pruggedcom rsg2100p 32m v4 xruggedcom rsg2100p 32m v5 xruggedcom rsg2100pncruggedcom rsg2100pnc 32m v4 xruggedcom rsg2100pnc 32m v5 xruggedcom rsg2200ruggedcom rsg2200ncruggedcom rsg2288 v4 xruggedcom rsg2288 v5 xruggedcom rsg2288nc v4 xruggedcom rsg2288nc v5 xruggedcom rsg2300 v4 xruggedcom rsg2300 v5 xruggedcom rsg2300nc v4 xruggedcom rsg2300nc v5 xruggedcom rsg2300p v4 xruggedcom rsg2300p v5 xruggedcom rsg2300pnc v4 xruggedcom rsg2300pnc v5 xruggedcom rsg2488 v4 xruggedcom rsg2488 v5 xruggedcom rsg2488nc v4 xruggedcom rsg2488nc v5 xruggedcom rsg907rruggedcom rsg908cruggedcom rsg909rruggedcom rsg910cruggedcom rsg920p v4 xruggedcom rsg920p v5 xruggedcom rsg920pnc v4 xruggedcom rsg920pnc v5 xruggedcom rsl910ruggedcom rsl910ncruggedcom rst2228ruggedcom rst2228pruggedcom rst2428pruggedcom rst916cruggedcom rst916pscalance m804pbscalance m812 1 adsl routerscalance m816 1 adsl routerscalance m826 2 shdsl routerscalance m874 2scalance m874 3scalance m874 3 3g router cnscalance m876 3scalance m876 3 rokscalance m876 4scalance m876 4 euscalance m876 4 namscalance mum853 1 a1scalance mum853 1 b1scalance mum853 1 euscalance mum856 1 a1scalance mum856 1 b1scalance mum856 1 cnscalance mum856 1 euscalance mum856 1 rowscalance s615 eec lan routerscalance s615 lan routerscalance sc622 2cscalance sc626 2cscalance sc632 2cscalance sc636 2cscalance sc642 2cscalance sc646 2cscalance w1748 1 m12scalance w1788 1 m12scalance w1788 2 eec m12scalance w1788 2 m12scalance w1788 2ia m12scalance w721 1 rj45scalance w722 1 rj45scalance w734 1 rj45scalance w734 1 rj45 usascalance w738 1 m12scalance w748 1 m12scalance w748 1 rj45scalance w761 1 rj45scalance w774 1 m12 eecscalance w774 1 rj45scalance w774 1 rj45 usascalance w778 1 m12scalance w778 1 m12 eecscalance w778 1 m12 eec usascalance w786 1 rj45scalance w786 2 rj45scalance w786 2 sfpscalance w786 2ia rj45scalance w788 1 m12scalance w788 1 rj45scalance w788 2 m12scalance w788 2 m12 eecscalance w788 2 rj45scalance wab762 1scalance wam763 1scalance wam763 1 mescalance wam763 1 usscalance wam766 1scalance wam766 1 mescalance wam766 1 usscalance wam766 1 eecscalance wam766 1 eec mescalance wam766 1 eec usscalance wub762 1scalance wub762 1 ifeaturesscalance wum763 1scalance wum763 1 usscalance wum766 1scalance wum766 1 mescalance wum766 1 usascalance x302 7 eec 230v coatedscalance x302 7 eec 230vscalance x302 7 eec 24v coatedscalance x302 7 eec 24vscalance x302 7 eec 2x 230v coatedscalance x302 7 eec 2x 230vscalance x302 7 eec 2x 24v coatedscalance x302 7 eec 2x 24vscalance x304 2fescalance x306 1ld fescalance x307 2 eec 230v coatedscalance x307 2 eec 230vscalance x307 2 eec 24v coatedscalance x307 2 eec 24vscalance x307 2 eec 2x 230v coatedscalance x307 2 eec 2x 230vscalance x307 2 eec 2x 24v coatedscalance x307 2 eec 2x 24vscalance x307 3scalance x307 3ldscalance x308 2scalance x308 2ldscalance x308 2lhscalance x308 2mscalance x308 2m poescalance x308 2m tsscalance x310scalance x310fescalance x320 1 fescalance x320 1 2ld fescalance x408 2scalance xb205 3 sc pnscalance xb205 3 st e ipscalance xb205 3 st pnscalance xb205 3ld sc e ipscalance xb205 3ld sc pnscalance xb206 2 scscalance xb206 2 st bfocscalance xb206 2 ldscalance xb206 2 stscalance xb206 2ldscalance xb208 e ipscalance xb208 pnscalance xb213 3 sc e ipscalance xb213 3 sc pnscalance xb213 3 st e ipscalance xb213 3 st pnscalance xb213 3ld sc e ipscalance xb213 3ld sc pnscalance xb216 e ipscalance xb216 pnscalance xc206 2 scscalance xc206 2 st bfocscalance xc206 2g poescalance xc206 2g poe 54 v dcscalance xc206 2g poe eec 54 v dcscalance xc206 2sfpscalance xc206 2sfp eecscalance xc206 2sfp gscalance xc206 2sfp g eip defscalance xc206 2sfp g eecscalance xc208scalance xc208eecscalance xc208gscalance xc208g eip defscalance xc208g eecscalance xc208g poescalance xc208g poe 54 v dcscalance xc216scalance xc216 3g poescalance xc216 3g poe 54 v dcscalance xc216 4cscalance xc216 4c gscalance xc216 4c g eip defscalance xc216 4c g eecscalance xc216eecscalance xc224scalance xc224 4c gscalance xc224 4c g eip defscalance xc224 4c g eecscalance xc316 8scalance xc324 4scalance xc324 4 eecscalance xc332scalance xc416 8scalance xc424 4scalance xc432scalance xch328scalance xcm324scalance xcm328scalance xcm332scalance xf204scalance xf204 dnascalance xf204 2bascalance xf204 2ba dnascalance xf204gscalance xm408 4cscalance xm408 4c l3 intscalance xm408 8cscalance xm408 8c l3 intscalance xm416 4cscalance xm416 4c l3 intscalance xp208scalance xp208 ethernet ipscalance xp208eecscalance xp208gscalance xp208g eecscalance xp208g poe eecscalance xp208g ppscalance xp208poe eecscalance xp216scalance xp216 ethernet ipscalance xp216 v2scalance xp216eecscalance xp216eec v2scalance xp216gscalance xp216g eecscalance xp216g poe eecscalance xp216poe eecscalance xp216poe eec v2scalance xr302 32scalance xr322 12scalance xr324 12m 230v ports on frontscalance xr324 12m 230v ports on rearscalance xr324 12m 24v ports on frontscalance xr324 12m 24v ports on rearscalance xr324 12m ts 24vscalance xr324 4m eec 100 240vac 60 250vdc ports on frontscalance xr324 4m eec 100 240vac 60 250vdc ports on rearscalance xr324 4m eec 24v ports on frontscalance xr324 4m eec 24v ports on rearscalance xr324 4m eec 2x 100 240vac 60 250vdc ports on frontscalance xr324 4m eec 2x 100 240vac 60 250vdc ports on rearscalance xr324 4m eec 2x 24v ports on frontscalance xr324 4m eec 2x 24v ports on rearscalance xr324 4m poe 230v ports on frontscalance xr324 4m poe 230v ports on rearscalance xr324 4m poe 24v ports on frontscalance xr324 4m poe 24v ports on rearscalance xr324 4m poe ts 24v ports on frontscalance xr324wg 24 x fe ac 230vscalance xr324wg 24 x fe dc 24vscalance xr326 2c poe wgscalance xr326 2c poe wg without ulscalance xr326 8scalance xr326 8 eecscalance xr328 4c wg 24xfe 4xge 24vscalance xr328 4c wg 24xfe 4xge dc24vscalance xr328 4c wg 24xfe 4xge ac230vscalance xr328 4c wg 28xge ac 230vscalance xr328 4c wg 28xge dc 24vscalance xr502 32scalance xr522 12scalance xr524 8c 1x230vscalance xr524 8c 1x230v l3 intscalance xr524 8c 24vscalance xr524 8c 24v l3 intscalance xr524 8c 2x230vscalance xr524 8c 2x230v l3 intscalance xr524 8wgscalance xr526 8scalance xr526 8c 1x230vscalance xr526 8c 1x230v l3 intscalance xr526 8c 24vscalance xr526 8c 24v l3 intscalance xr526 8c 2x230vscalance xr526 8c 2x230v l3 intscalance xr528 6mscalance xr528 6m 2hr2 l3 intscalance xr528 6m 2hr2scalance xr528 6m l3 intscalance xr552 12mscalance xr552 12m 2hr2 l3 intscalance xr552 12m 2hr2scalance xrh334 24 v dc 8xfo ccscalance xrm334 230 v ac 12xfoscalance xrm334 230 v ac 8xfoscalance xrm334 230v ac 2x10g 24xsfp 8xsfpscalance xrm334 24 v dc 12xfoscalance xrm334 24 v dc 8xfoscalance xrm334 24v dc 2x10g 24xsfp 8xsfpscalance xrm334 2x230 v ac 12xfoscalance xrm334 2x230 v ac 8xfoscalance xrm334 2x230v ac 2x10g 24xsfp 8xsfpsicam ak 3sicam bcsicam gridedge classicsicam gridedge applications for sicam 8 platformsicam gridpasssicam tmsicore base systemsinec inssiplus net scalance x308 2siplus net scalance xc206 2siplus net scalance xc206 2sfpsiplus net scalance xc208siplus net scalance xc216 4csiprotec 5 cp200 devicessiprotec 5 6md84 cp300siprotec 5 6md85 cp300siprotec 5 6md86 cp300siprotec 5 6md89 cp300siprotec 5 6md89 cp300 v9 6xsiprotec 5 6mu85 cp300siprotec 5 7ke85 cp300siprotec 5 7sa82 cp100siprotec 5 7sa82 cp150siprotec 5 7sa86 cp300siprotec 5 7sa87 cp300siprotec 5 7sd82 cp100siprotec 5 7sd82 cp150siprotec 5 7sd86 cp300siprotec 5 7sd87 cp300siprotec 5 7sj81 cp100siprotec 5 7sj81 cp150siprotec 5 7sj82 cp100siprotec 5 7sj82 cp150siprotec 5 7sj85 cp300siprotec 5 7sj86 cp300siprotec 5 7sk82 cp100siprotec 5 7sk82 cp150siprotec 5 7sk85 cp300siprotec 5 7sl82 cp100siprotec 5 7sl82 cp150siprotec 5 7sl86 cp300siprotec 5 7sl87 cp300siprotec 5 7ss85 cp300siprotec 5 7st85 cp300siprotec 5 7st85 cp300 v9 6xsiprotec 5 7st86 cp300siprotec 5 7st86 cp300 v9 8xsiprotec 5 7sx82 cp150siprotec 5 7sx85 cp300siprotec 5 7sy82 cp150siprotec 5 7um85 cp300siprotec 5 7ut82 cp100siprotec 5 7ut82 cp150siprotec 5 7ut85 cp300siprotec 5 7ut86 cp300siprotec 5 7ut87 cp300siprotec 5 7ve85 cp300siprotec 5 7vk87 cp300siprotec 5 7vu85 cp300siprotec 5 compact 7sx800 cp050

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
9CVSS 3.1CRITICAL——cvelistV5

Public exploit

Capability, not use: code existing is a different claim from anyone running it.

Indexed by

poc in github

References

13 on the record

Elsewhere on this site

  • ietfevery CVE for this vendor
  • siemensevery CVE for this vendor

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.