Skip to content
OpenAdvisories
Critical SSA-723487 1 CVE

SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products

Published Jul 9, 2024 · Updated Jun 9, 2026 · Revision 11

Vendor: Siemens Product: RUGGEDCOM CROSSBOW Product: RUGGEDCOM i800 Product: RUGGEDCOM i800NC Product: RUGGEDCOM i801 Product: RUGGEDCOM i801NC Product: RUGGEDCOM i802 Product: RUGGEDCOM i802NC Product: RUGGEDCOM i803 Product: RUGGEDCOM i803NC Product: RUGGEDCOM M2100 Product: RUGGEDCOM M2100NC Product: RUGGEDCOM M2200 Product: RUGGEDCOM M2200NC Product: RUGGEDCOM M969 Product: RUGGEDCOM M969NC Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: RUGGEDCOM RMC30 Product: RUGGEDCOM RMC30NC Product: RUGGEDCOM RMC8388 V4.X Product: RUGGEDCOM RMC8388 V5.X Product: RUGGEDCOM RMC8388NC V4.X Product: RUGGEDCOM RMC8388NC V5.X Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX MX5000RE Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 +121 more

Summary

This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products.

The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SCALANCE or RUGGEDCOM devices) and a RADIUS server (e.g., SINEC INS), to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).

Further details incl. external references can be found in the chapter "Additional Information".
Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information".
Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter "Additional Information" for details.

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine

Revision history

  1. #11

    Added fix for SCALANCE SC-600 Family

  2. #10

    Added fix for SCALANCE W-700 IEEE 802.11n family.

  3. #9

    Added fix for RUGGEDCOM ROX II family

  4. #8

    Added fix for SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG family, for SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family (MSPS V1.3), for RUGGEDCOM ROS V5.X family and for SINEC INS (relay feature); Clarified the applicability of the MSPS V1.3 and the SINEC OS V3.2 fix releases for product families that support both

  5. #7

    Clarified that SINEC INS is only affected when the Relay feature is used; added fix for the RUGGEDCOM RST2428P, SCALANCE XC-300, SCALANCE XC-400 and SCALANCE XR-300 (6GK5334-xTSxx) families and for some of the devices in the SCALANCE XM-400/XR-500 and SCALANCE XCM-/XRM-/XCH-/XRH-300 families

  6. #6

    Added fix for SCALANCE X-300 family (incl. X408 and SIPLUS NET variants)

  7. #5

    Added fix for SCALANCE W-700 IEEE 802.11ax family and for SCALANCE M-800 family (incl. S615, MUM-800 and RM1224)

  8. #4

    Added fix (and related important recommendations in chapter Additional Information) for RUGGEDCOM ROS V4.x devices; Added additional SINEC OS-based devices as affected products: RUGGEDCOM RST2428P and SCALANCE XC-300, XR-300, XC-400 families, and additional devices in the SCALANCE XR-500 family

  9. #3

    Added fix for RUGGEDCOM CROSSBOW

  10. #2

    Clarified that the fix for SCALANCE X-300 family (incl. X408 and SIPLUS NET variants) in V4.1.8 only covers RADIUS client mitigation C1, but not C2

  11. #1

    Publication Date

References