CyberzSOC

A critical vulnerability, identified as CVE-2024-3596, has been discovered in the RADIUS (Remote Authentication Dial-In User Service) protocol, allowing for man-in-the-middle (MitM) attacks that bypass authentication mechanisms [1]. Dubbed the Blast-RADIUS attack, this vulnerability leverages an MD5 collision attack to forge authentication responses, potentially granting unauthorised access to network resources. In particular multiple CISCO products are impacted by this vulnerability [2, 3]. Other platforms are impacted as well, although the exact severity varies [4, 5] Due to the high severity of this vulnerability, CERT-EU strongly recommends patching as soon as possible. The Blast-RADIUS attack targets the RADIUS/UDP protocol, which is widely used for authentication in various network services. The vulnerability arises from the use of MD5 in the RADIUS protocol’s Response Authenticator.