Overview
A vulnerability in the RADIUS protocol allows an attacker allows an attacker to forge an authentication response in cases where a Message-Authenticator attribute is not required or enforced. This vulnerability results from a cryptographically insecure integrity check when validating authentication responses from a RADIUS server.
Description
RADIUS is a popular lightweight authentication protocol used for networking devices specified in IETF 2058 as early as 1997 (obsoleted by RFC 2138 and then RFC 2865. There have been several other IETF standards (RADIUS/TCP, RADIUS/TLS and RADIUS/DTLS) that cover and enhance various parts of the specification for the use of RADIUS in authentication. RADIUS is widely used to authenticate both users and devices and widely supported by networking devices, from basic network switches to more complex VPN solutions. Recently, RADIUS has also been adopted in much of the cloud services that provide tiered, role-based access-control to resources. As a client-server protocol, RADIUS uses a Request-Response model to verify authentication requests and further provide any role-based access using Groups. RADIUS can also be proxied to support multi-tenant roaming access services.
A vulnerability in the verification of RADIUS Response from a RADIUS server has been disclosed by a team of researchers from UC San Diego and their partners. An attacker, with access to the network where the RADIUS protocol is being transmitted, can spoof a UDP-based RADIUS Response packet to modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response, with almost any content, completely under the attackers control. This allows the attacker to transform a Reject into an Accept without knowledge of the shared secret between the RADIUS client and server. The attack is possible due to a basic flaw in the RADIUS protocol specification that uses a MD5 hash to verify the response, along with the fact that part of the hashed text is predictable allowing for a chosen-prefix collision. The attack, demonstrated by UCSD team, takes advantage of the chosen-prefix collision of the MD5 message in a novel way. The widespread use of RADIUS and its adoption into the cloud allows for such attacks to pose a reasonable threat to the authentication verification process that relies on RADIUS.
RADIUS servers that only perform Extensible Authentication Protocol (EAP), as specified in RFC 3579, are unaffected by this attack. The EAP authentication messages require the Message-Authenticator attribute, which will prevent these attacks from succeeding. The use of TLS (or DTLS) encryption can also prevent such attacks from succeeding. However, RADIUS over TCP itself can still be susceptible to this attack, with more advanced man-in-the-middle scenarios, to successfully attack the TCP connection.
Finally as explained by Alan Dekok, developer of FreeRadius open source software -
The key to the attack is that in many cases, Access-Request packets have no authentication or integrity checks. An attacker can then perform a chosen prefix attack, which allows modifying the Access-Request in order to replace a valid response with one chosen by the attacker. Even though the response is authenticated and integrity checked, the chosen prefix vulnerability allows the attacker to modify the response packet, almost at will.
Impact
An attacker with access to the network where RADIUS Access-Request is transported can craft a response to the RADIUS server irrespective of the type of response (Access-Accept, Access-Reject, Access-Challenge, or Protocol-Error) to modify the response to any of the valid responses. This can allow an attacker to change the Reject response to an Accept or vice versa. The attack can also potentially intercept an Access-Challenge, typically used in Multi-Factor Authentication (MFA), and modify it to an Access-Accept, thus bypassing the MFA used within RADIUS. Due to the flexible, proxied nature of the RADIUS protocol, any server in the chain of proxied RADIUS servers can be targeted to succeed in the attack.
Solution
Device Manufacturers
RADIUS-compliant software and hardware manufacturers should adopt the recommendations from the Article document to mitigate the risk of the RADIUS protocol limitations identified in this attack. Manufacturers who bundle the open-source RADIUS implementations, such as FreeRadius, should update to the latest available software for both clients and servers and, at a minimum, require the use of the Message-Authenticator for RADIUS authentication.
Operators
Network operators who rely on the RADIUS-based protocol for device and/or user authentication should update their software and configuration to a secure form of the protocol for both clients and servers. This can be done by enforcing TLS or DTLS encryption to secure the communications between the RADIUS client and server. Where possible, network isolation and secure VPN tunnel communications should be enforced for the RADIUS protocol to restrict access to these network resources from untrusted sources.
Acknowledgements
Thanks to Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl who collaborated for this research and supported coordinated vulnerability disclosure to reach multiple vendors and stakeholders. Thanks to Alan Dekok for spearheading the IETF proposal and recommendations. This document was written by Vijay Sarvepalli and Timur Snoke.
Vendor Information
Advantech Taiwan Affected
Statement Date: March 12, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Advantech will apply the recommended actions per suggested from document VU# 456537 accordingly.
Arista Networks Affected
Statement Date: February 08, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Arista Networks has multiple products which use RADIUS. We plan to issue a security advisory at https://www.arista.com/en/support/advisories-notices that will discuss per-product solutions.
Aruba Networks Affected
Statement Date: July 12, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We have not received a statement from the vendor.
Check Point Affected
Statement Date: September 11, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Check Point response to CVE-2024-3596 - Blast-RADIUS attack https://support.checkpoint.com/results/sk/sk182516
D-Link Systems Inc. Affected
Statement Date: July 02, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
D-Link Corporation has investigated, we are integrating patches as they are available.
We will publish a support announcement at: https://support.dlink.com/index.aspx once relavent product patches are available.
Feel free to reach out to security@dlink.com if there is any questions regarding security of our products.
FreeBSD Affected
Statement Date: May 06, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
FreeBSD has a vulnerable implementation of libradius shipped with the base which is solely used by the pam_radius implementation as shipped. Software may link against the base system and inherit the vulnerability.
FreeRADIUS Affected
Statement Date: April 11, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We are releasing new versions of FreeRADIUS to address this issue. We are also releasing new versions of pam_radius and mod_auth_radius.
Juniper Networks Affected
Statement Date: October 15, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Juniper SIRT is aware of the newly announced vulnerability in RADIUS, assigned CVE-2024-3596. Radius protocol susceptible to forgery attacks vulnerability.
This issue potentially affects Junos OS, Junos OS Evolved, cRPD, Mist, Junos Space, 128T, Paragon, Contrail, CTP View/CTP OS, Northstar, Apstra, Security Director Cloud, Network and Security Manager, SkyATP/JATP, STRM Security Threat Response Manager, Appformix, Juniper Sky Enterprise and problem reports have been escalated to Development.
This issue does not affect JSA Series, JIMS Juniper Identity Management Service and Juniper Networks SecIntel.
Refer to https://supportportal.juniper.net/JSA88210 for more information.
LANCOM Systems GmbH Affected
Statement Date: April 24, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
LANCOM is tracking this vulnerability. Some products are affected and firmware-fixes will be prepared ahead of the publication date where possible.
Microsoft Affected
Statement Date: July 02, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Microsoft has addressed this issue in affected versions of Windows as part of the July Patch Tuesday, documented under CVE-2024-3596.
References
/n software Inc. Affected
Statement Date: May 02, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We have not received a statement from the vendor.
Okta Inc. Affected
Statement Date: February 22, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Regarding the reported vulnerability, from the information that was provided, it seems the affected scenario is when an attacker has control over the client's network/proxy, it can forge the request to make it seem like the client authenticated to the server. The underlying issue here is the md5 hash collision that is in the RFC for UDP RADAR protocol for authentication verification https://datatracker.ietf.org/doc/html/rfc2865#page-11.
Since Okta RADAR allows the client to use any tool that supports RADAR protocol to connect to the server, this is beyond Okta's control to make any changes at the moment. To clarify let's say we use sha256 hash (a stronger hash to prevent collision) instead of md5 as mentioned in the RFC - we will end up breaking freeradius, javaradius (and other clients) as they would still use md5 hashes to compute the changes. In an ideal situation a solution should be proposed that should be adopted by the RADIUS clients first (or both clients and server together or an update to the RFC) in an if/else fashion on md5 or a stronger hash should be used. After that all the radius servers should be updated with this stronger protocol. Let us know if there is any further update to this issue and/or if any other actions that needs to be taken.
OpenVPN Technologies Affected
Statement Date: February 09, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
OpenVPN itself is not vulnerable by this attack however software that uses OpenVPN or is closely related to OpenVPN is vulnerable. OpenVPN Access Server is vulnerable and that will by addressed by the suggested mitigations. The externally maintained openvpn-auth-radius plugin for OpenVPN might be also vulnerable. We are trying to reach out to its maintainers.
Palo Alto Networks Affected
Statement Date: July 25, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Palo Alto Networks published the following advisory: https://security.paloaltonetworks.com/CVE-2024-3596
References
Radiator Software Affected
Statement Date: July 10, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
Fixed in Radiator v4.29 released on the 9th of July 2024. Radiator Software security notice Radiator revision history for v4.29 and earlier
Red Hat Affected
Statement Date: February 07, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We have not received a statement from the vendor.
RSA Affected
Statement Date: April 12, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We have not received a statement from the vendor.
Siemens Affected
Statement Date: July 12, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
The impact of Siemens products is described in Siemens Security Advisories published on https://www.siemens.com/cert/advisories. Search for CVE-2024-3596 to find the relevant advisories.
Current publication(s): * SSA-723487
References
SUSE Linux Affected
Statement Date: May 15, 2024
| CVE-2024-3596 | Affected |
Vendor Statement
We have not received a statement from the vendor.
Barracuda Networks Not Affected
Statement Date: October 02, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Calix Not Affected
Statement Date: July 02, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
Calix Cloud services only leverage RADIUS accounting, rather than RADIUS authentication, which is where this vulnerability lies. RADIUS accounting is a proxy of existing session statuses that have already been authenticated. Accounting proxy was built into RADIUS as an add-on to share session information with other ISPs. Calix uses this functionality for endpoint mapping, accepting only the RADIUS username and Framed IP address, and rejecting all other AVP data in the packet.
eCosCentric Not Affected
Statement Date: July 11, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
eCosPro RTOS does not supply RADIUS support
eero Not Affected
Statement Date: July 10, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Fastly Not Affected
Statement Date: July 10, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Honeywell Not Affected
Statement Date: March 08, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
LiteSpeed Technologies Not Affected
Statement Date: July 10, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Paessler Not Affected
Statement Date: July 11, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Peplink Not Affected
Statement Date: July 11, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Phoenix Contact Not Affected
Statement Date: May 23, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Rockwell Automation Not Affected
Statement Date: April 25, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
SolarWinds Not Affected
Statement Date: April 10, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
We have not received a statement from the vendor.
Wi-Fi Alliance Not Affected
Statement Date: June 17, 2024
| CVE-2024-3596 | Not Affected |
Vendor Statement
In all Wi-Fi Alliance specifications, RADIUS is solely used to transport EAP (802.1X) messages. RADIUS support for EAP is defined in RFC 3579, which requires every Access-Accept and Access-Reject EAP message to be authenticated using a Message-Authenticator attribute. In other words, these messages cannot be forged using the technique described in this attack.
Illumos Unknown
Statement Date: July 10, 2024
| CVE-2024-3596 | Unknown |
Vendor Statement
The only subsystems in illumos-gate that use RADIUS are the WPA supplicant (wpad), which always has EAP, and the iSCSI subsystem. Initial inspections of the iSCSI seem to indicate that Message-Authenticator is always set on Request messages (IOW, the MAY in the spec is interpreted as a MUST by the illumos iSCSI implementation).
Further consultations with iSCSI experts will confirm or deny. I'm leaving illumos as "unknown" until I learn more.
A10 Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
ACCESS Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Actelis Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Actiontec Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
ADTRAN Unknown
Statement Date: February 21, 2024
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Advantech Czech Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Akamai Technologies Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Alcatel-Lucent Enterprise Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Allied Telesis Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Amazon Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Apple Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Arcadyan Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
ARRIS Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
ASUSTeK Computer Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Atheros Communications Inc Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
AT&T Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Avaya Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Belden Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Belkin Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Broadcom Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Brocade Communication Systems Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Cambium Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ceragon Networks Inc Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Cisco Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Cloudflare Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Comcast Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Commscope Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Contiki OS Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Cradlepoint Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
dd-wrt Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Debian GNU/Linux Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Dell Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Dell EMC Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Dell SecureWorks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Deutsche Telekom Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Digi International Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
dnsmasq Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Duo Security Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ericsson Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Espressif Systems Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Extreme Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
F5 Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Force10 Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Forcepoint Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Fortinet Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
General Electric Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Gentoo Linux Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Google Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Green Hills Software Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
HardenedBSD Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
HCC Embedded Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Hewlett Packard Enterprise Unknown
Statement Date: April 24, 2024
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Hitachi Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
hostapd Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
HP Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
HTC Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
IBM Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
IBM Corporation (zseries) Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Infoblox Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Intel Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Lantronix Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Lenovo Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
LG Electronics Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
LibreSSL Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
lwIP Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Marvell Semiconductor Unknown
Statement Date: June 12, 2024
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
McAfee Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
MediaTek Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Medtronic Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Metaswitch Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Microchip Technology Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Micro Focus Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
MikroTik Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Miredo Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Mitel Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Motorola Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Muonics Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NEC Corporation Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NetBSD Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NetComm Wireless Limited Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NETGEAR Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NETSCOUT Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Nokia Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Nozomi Networks Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
NVIDIA Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
OMRON Industrial Automation Unknown
Statement Date: February 06, 2024
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
OpenBSD Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
OpenConnect Ltd Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Openwall GNU/*/Linux Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
OpenWRT Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Oracle Corporation Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
pfSense Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Philips Electronics Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ping Identity Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Proxim Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Pulse Secure Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
QLogic Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
QNAP Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Qualcomm Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Riverbed Technologies Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ruckus Wireless Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Samsung Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Samsung Mobile Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Schneider Electric Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Sierra Wireless Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
SITA Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
SonicWall Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Sophos Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Symantec Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Synology Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
TDS Telecom Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Tenable Network Security Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
TippingPoint Technologies Inc. Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Tizen Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
TP-LINK Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Treck Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Turbolinux Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ubiquiti Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ubiquitous Telecommunications Technology Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Ubuntu Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Untangle Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Vantiva Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Viasat Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
VMware Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Wind River Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Zyxel Unknown
| CVE-2024-3596 | Unknown |
Vendor Statement
We have not received a statement from the vendor.
Other Information
| CVE IDs: | CVE-2024-3596 |
| API URL: | VINCE JSON | CSAF |
| Date Public: | 2024-07-09 |
| Date First Published: | 2024-07-09 |
| Date Last Updated: | 2024-10-15 20:37 UTC |
| Document Revision: | 13 |