{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","title":"Blast-RADIUS CHAP and PAP Authentication Vulnerability CVE-2024-3596","distribution":{"tlp":{"label":"CLEAR"}},"publisher":{"category":"vendor","name":"WatchGuard PSIRT","namespace":"https://www.watchguard.com"},"tracking":{"id":"WGSA-2024-00013","status":"final","version":"14","initial_release_date":"2024-07-10T20:55:28+00:00","current_release_date":"2026-07-28T02:11:54.774380+00:00","revision_history":[{"date":"2024-07-10T20:55:28+00:00","number":"14","summary":"Initial release."}]},"references":[{"summary":"vendor-advisory","url":"https://psirt.watchguard.com/WGSA-2024-00013"},{"summary":"cve","url":"https://www.cve.org/CVERecord?id=CVE-2024-3596"}],"notes":[{"category":"summary","text":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\n\nThis vulnerability allows an attacker performing a man-in-the-middle attack between a vulnerable system and a RADIUS server to bypass authentication and escalate privileges when RADIUS authentication is used with either CHAP or PAP authentication.\n\nFireware OS and the WatchGuard Wireless APs both support the RADIUS protocol. WPA Enterprise authentication in Fireware OS and WatchGuard Wireless APs and do not use PAP or CHAP-based authentication and are not affected","title":"Summary"}]},"product_tree":{"branches":[{"category":"vendor","name":"WatchGuard","branches":[{"category":"product_name","name":"Fireware OS","branches":[{"category":"product_version_range","name":"all versions","product":{"name":"Fireware OS all versions","product_id":"CSAFPID-46ae0b14-8bdb-41f9-a57b-563a6e76c5c7"}}]},{"category":"product_name","name":"Secure Wi-Fi","branches":[{"category":"product_version_range","name":"all versions","product":{"name":"Secure Wi-Fi all versions","product_id":"CSAFPID-6737224d-68ea-4d9e-80e7-1f38f4c398d8"}}]},{"category":"product_name","name":"Dimension","branches":[{"category":"product_version_range","name":"all versions","product":{"name":"Dimension all versions","product_id":"CSAFPID-d36d565e-228e-4d9a-888a-9be70889d829"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.\n\nThis vulnerability allows an attacker performing a man-in-the-middle attack between a vulnerable system and a RADIUS server to bypass authentication and escalate privileges when RADIUS authentication is used with either CHAP or PAP authentication.\n\nFireware OS and the WatchGuard Wireless APs both support the RADIUS protocol. WPA Enterprise authentication in Fireware OS and WatchGuard Wireless APs and do not use PAP or CHAP-based authentication and are not affected","title":"Summary"}],"product_status":{"known_affected":["CSAFPID-46ae0b14-8bdb-41f9-a57b-563a6e76c5c7","CSAFPID-d36d565e-228e-4d9a-888a-9be70889d829"],"known_not_affected":["CSAFPID-6737224d-68ea-4d9e-80e7-1f38f4c398d8"]},"cve":"CVE-2024-3596"}]}