A critical vulnerability in the Remote Authentication Dial-In User Service (RADIUS) protocol has been discovered, affecting multiple Cisco products. The vulnerability, CVE-2024-3596, allows an attacker to forge RADIUS responses, potentially leading to unauthorized access to network resources.
The vulnerability, known as “Blast-RADIUS,” exploits a fundamental flaw in the RADIUS protocol’s use of MD5 for response authentication. An attacker can modify any valid RADIUS response to another response of their choice without knowing the shared secret between the RADIUS client and server.
Cisco has identified several vulnerable products across various categories, including Network and Content Security Devices, Network Management and Provisioning, Routing and Switching, and Unified Computing. The company urges customers to stay informed about the ongoing investigation and potential impacts on their networks. There are currently no workarounds for this vulnerability.
Other vendors, including Microsoft, RedHat, and Juniper Networks, are also investigating the impact on their products. To protect their networks, Cisco recommends implementing mitigations such as using TLS or DTLS encryption, network isolation, software updates, and reviewing RADIUS configurations.
Source: https://cybersecuritynews.com/radius-protocol-vulnerability-cisco/