Blast-RADIUS CHAP and PAP Authentication Vulnerability CVE-2024-3596

Summary #

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

This vulnerability allows an attacker performing a man-in-the-middle attack between a vulnerable system and a RADIUS server to bypass authentication and escalate privileges when RADIUS authentication is used with either CHAP or PAP authentication.

Fireware OS and the WatchGuard Wireless APs both support the RADIUS protocol. WPA Enterprise authentication in Fireware OS and WatchGuard Wireless APs and do not use PAP or CHAP-based authentication and are not affected