Cisco Patches the Products Impacted by RADIUS Protocol Vulnerability

Cisco has issued patches for multiple products affected by a critical vulnerability in the RADIUS protocol. The vulnerability, identified as CVE-2024-3596, was disclosed by security researchers on July 7, 2024.

This flaw allows an on-path attacker to forge responses using a chosen prefix collision attack against the MD5 Response Authenticator signature. Cisco has been actively investigating its product line to identify and address the affected products.

CVE-2024-3596 – Summary of the Vulnerability

The vulnerability in the RADIUS protocol, as described under RFC 2865, makes it susceptible to forgery attacks by an on-path attacker.

The attacker can modify any valid response (Access-Accept, Access-Reject, or Access-Challenge) to another response using a chosen prefix collision attack against the MD5 Response Authenticator signature. This vulnerability impacts any RADIUS client and server.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Affected Products

Cisco has identified several products affected by this vulnerability and is working to release patches. The affected products include:

  • Network and Content Security Devices:
    • Adaptive Security Appliance (ASA)
    • Firepower Device Manager (FDM)
    • Firepower Management Center (FMC) Software
    • Firepower Threat Defense (FTD) Software
    • Identity Services Engine (ISE)
    • Secure Email Gateway
    • Secure Email and Web Manager
    • Secure Firewall
    • Secure Network Analytics
    • Secure Web Appliance
  • Network Management and Provisioning:
    • Application Policy Infrastructure Controller (APIC)
    • Crosswork Change Automation
    • Nexus Dashboard (formerly Application Services Engine)
  • Routing and Switching – Enterprise and Service Provider:
    • ASR 5000 Series Routers
    • Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
    • Catalyst SD-WAN Manager (formerly SD-WAN vManage)
    • Catalyst SD-WAN Validator (formerly SD-WAN vBond)
    • GGSN Gateway GPRS Support Node
    • IOS XE Software
    • IOS XR
    • IOx Fog Director
    • MDS 9000 Series Multilayer Switches
    • Nexus 3000 Series Switches
    • Nexus 7000 Series Switches
    • Nexus 9000 Series Switches (standalone NX-OS mode)
    • PGW Packet Data Network Gateway
    • SD-WAN vEdge Routers
    • System Architecture Evolution (SAE) Gateway
    • Ultra Packet Core
  • Unified Computing:
    • UCS Central Software
    • UCS Manager

Products Confirmed Not Vulnerable

Cisco has confirmed that the following products are not affected by this vulnerability:

  • Network Application, Service, and Acceleration:
    • Nexus Dashboard Insights (On Prem)
    • Secure Workload
  • Network and Content Security Devices:
    • Firepower 4100/9300 FXOS Firepower Chassis Manager
    • Secure Malware Analytics Appliance
    • Umbrella Active Directory (AD) Connector
  • Network Management and Provisioning:
    • Cisco Evolved Programmable Network Manager (EPNM)
    • DNA Spaces Connector
    • Policy Suite
  • Routing and Switching – Enterprise and Service Provider:
    • Ultra Cloud Core – Policy Control Function
  • Unified Computing:
    • UCS B-Series Blade Servers
  • Wireless:
    • Various Aironet and Catalyst Series Access Points

Currently, there are no workarounds for this vulnerability. However, RADIUS clients and servers configured to use DTLS or TLS over TCP are not exploitable, provided the traffic is not sent in plaintext.

Cisco advises customers to consult the Cisco bugs identified in the Vulnerable Products section for information about fixed software releases.

Customers should ensure their devices have sufficient memory and that the new releases support their hardware and software configurations.

Cisco’s prompt action in addressing the RADIUS protocol vulnerability underscores the importance of staying vigilant and updated on security advisories.

Customers are encouraged to regularly check Cisco’s Security Advisories page for updates and apply patches as soon as they are available to safeguard their networks.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

24 hours ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

1 day ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

1 day ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

1 day ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

1 day ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

2 days ago