CVE-2024-3596

A vulnerability in the RADIUS (Remote Authentication Dial-In User Service) protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof UDP-based RADIUS response packets. This can result in unauthorized access by modifying an Access-Reject response to an Access-Accept response, thereby compromising the authentication process.

Mitigation

Disable the use of RADIUS/UDP and RADIUS/TCP.
RADIUS/TLS or RADIUS/DTLS should be used.