Vulnerability Blast Radius: How to Measure and Reduce Impact | Blog | Endor Labs

What it is

Endor Labs' post on BlastRADIUS (CVE-2024-3596), a 30-year-old design flaw in the RADIUS protocol disclosed July 2024, rated critical (9.0+). The summary already covers the collision mechanism and affected device classes; what it omits is the mitigation detail and ordering, which is the reason to keep this.

How it works

The attacker sits on-path between a RADIUS client (e.g. a VPN concentrator) and server. A user authenticates with any username and a wrong password, so the server returns Access-Reject. The attacker intercepts that packet and uses a chosen-prefix MD5 collision to forge a valid Access-Accept, which the client accepts. No knowledge of the user's credentials or the client-server shared secret is required — only the ability to intercept and modify UDP traffic.

Affected

Any RADIUS deployment over UDP using non-EAP methods (PAP or CHAP): VPN gateways, enterprise firewalls (Palo Alto, Cisco, Fortinet, SonicWall), switches/routers using RADIUS for admin access, wireless APs, and ISP/telecom infrastructure. The flaw is in the protocol, so patching a single product does not resolve it.

What to do

The core fix is enforcing the Message-Authenticator attribute on all packets, which adds cryptographic integrity that defeats the forgery. For FreeRADIUS:

require_message_authenticator = auto

For commercial products, follow the vendor's CVE-2024-3596 advisory (Cisco, Palo Alto, and others have published specific guidance).

The page ranks mitigations by effort/effectiveness:

• Enable Message-Authenticator — low effort, high effectiveness
• Apply vendor patches — medium effort, high effectiveness
• Segment RADIUS traffic to management VLANs — medium effort, medium effectiveness (defense-in-depth; denies the attacker the on-path position even after patching)
• Migrate to RADIUS/TLS (RadSec) — high effort, very high effectiveness

Caveats

Network segmentation is a defense-in-depth layer, not a fix — it constrains reachability to the MITM position but does not close the protocol flaw. The remainder of the post is a general treatment of "blast radius" as a reachability-prioritization concept tied to Endor Labs' AURI product, which the existing summary already captures.