Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-02-10 | 1 | Disclosure1 |
| 2026-06-09 | 1 | Patch1 |
| 2026-06-11 | 1 | Active Exploitation1 |
| 2026-06-20 | 1 | General1 |
| 2026-09-13 | 1 | Patch1 |
اپدیت نصف شبی: 1. بالاخره MA اضافه شد. میتونین واسه هر Peer جداگانه تعیین کنین که سرور MA پکت رو وریفای کنه یا نه. به صورت پیشفرض خاموشه ولی کسی دوست نداره BlastRADIUS Attack (CVE-2024-3596) بخوره پس بنظرم روشنش کنین. /
Post summary
The post recommends enabling MA verification per peer as a workaround to protect against BlastRADIUS Attack (CVE-2024-3596), noting the feature is disabled by default.
حمله RADIUS Spoofing: نوعی حمله MITM که پروتکل RADIUS رو هدف می‌گیره. مهاجم با جعل پاسخ‌ها (مثل تغییر هش MD5) می‌تونه احراز هویت رو دور بزنه و دسترسی غیرمجاز بگیره. (CVE-2024-3596) حمله Traffic Flood: سیل ترافیک برای از کار انداختن سرور. UDP Flood: ارسال انبوه بسته‌های UDP به پورت‌های تصادفی. ICMP Flood: ارسال انبوه پینگ‌ها (ICMP echo) برای اشغال منابع. هر دو DDoS هستن.
Post summary
The text describes CVE-2024-3596 as a RADIUS spoofing vulnerability that can bypass authentication by modifying MD5 hashes, but it offers no evidence of active exploitation, patching, or PoC.
[CVE Analysis] CVE-2024-3596: RADIUS Forgery (Blast-RADIUS) in Schneider Electric Modicon Managed Switches https://breachspider.com/intel/2026-06-20-cve-2024-3596-radius-forgery-blast-radius-in-schneider-elect #ICS #OTSecurity #SCADA #CriticalInfrastructure
Post summary
The tweet shares a link to an analysis of CVE‑2024‑3596, a RADIUS forging flaw in Schneider Electric switches, but it lacks details on exploits, patches, or active use.
TRC analysis shows attackers exploiting CVE-2024-3596 in Schneider Electric switches can manipulate RADIUS authentication responses to escalate privileges and move laterally through industrial networks. Runtime segmentation helps contain such post-compromise activity across connected OT devices. #Vulnerability 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/schneider-electric-modicon-switches-cve-2024-3596
Post summary
ATickers are actively exploiting CVE‑2024‑3596 in Schneider Electric switches, manipulating RADIUS authentication to gain higher privileges and move laterally through industrial networks, as detailed in the TRC analysis.
🪟 CVE-2024-3596 is the classic “stop disabling security knobs” reminder. If RADIUS Message-Authenticator gets turned off, your OT network isn’t “simpler”—it’s just breakable. #Windows #Microsoft #CVE #Security https://windowsforum.com/threads/schneider-blastradius-cve-2024-3596-fix-switch-radius-message-authenticator.424153/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #Cve20243596 #IndustrialCybersecurity https://t.co/VdcnzxffNr
Post summary
The tweet points out CVE‑2024‑3596, warns against disabling the RADIUS Message‑Authenticator, and directs readers to a forum thread offering a fix or workaround.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | broadcom | brocade_sannav | - | - | - |
| OS | broadcom | fabric_operating_system | - | - | - |
| App | freeradius | freeradius | - | - | - |
| OS | sonicwall | sonicos | - | - | - |