Vulnetix
Try Vulnetix Request Demo
SSA-723487 PUBLISHED CVSS 9 CRITICAL

This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SCALANCE, RUGGEDCOM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., SCALANCE or RUGGEDCOM devices) and a RADIUS server (e.g., SINEC INS), to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials). Further details incl. external references can be found in the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information". Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter "Additional Information" for details.

Risk Scores

CVSS v3.1
9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
RUGGEDCOM M2100NC
RUGGEDCOM i803NC
RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)
RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)
RUGGEDCOM i801NC
RUGGEDCOM M2200
RUGGEDCOM i801
RUGGEDCOM i800NC
RUGGEDCOM i803
RUGGEDCOM CROSSBOW
RUGGEDCOM i800
RUGGEDCOM RMC8388 V4.X
RUGGEDCOM i802
RUGGEDCOM M969
RUGGEDCOM RMC30
RUGGEDCOM M2100
RUGGEDCOM M969NC
RUGGEDCOM M2200NC
RUGGEDCOM RMC30NC
RUGGEDCOM i802NC

Timeline

References

Open in Interactive Console →