Blast-RADIUS CHAP and PAP Authentication Vulnerability CVE-2024-3596

Updated 2024-09-11: Added initial impact analysis

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

This vulnerability allows an attacker performing a man-in-the-middle attack between a vulnerable system and a RADIUS server to bypass authentication and escalate privileges when RADIUS authentication is used with either CHAP or PAP authentication.