CVE-2024-3596

CVE-2024-3596 is a critical vulnerability affecting the RADIUS Protocol (RFC 2865), allowing a local attacker to forge RADIUS responses (Access-Accept, Access-Reject, Access-Challenge) using a chosen-prefix collision attack against the MD5 Response Authenticator. This impacts various products including Broadcom, FreeRADIUS, and SonicWall, with Siemens also issuing advisories for their SCALANCE, RUGGEDCOM, SIPROTEC, and SICAM lines. With a CVSS score of 9.0 (CRITICAL), the vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, despite high attack complexity. Its high EPSS score and FAUCET Risk Score of 96/100 indicate significant potential for exploitation. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered substantial community discussion and media coverage, suggesting high awareness and potential for future exploitation.