Critical Vulnerability Affecting RADIUS Authentication on Fortinet Solutions (BlastRADIUS)
A critical vulnerability known as BlastRADIUS affects the RADIUS protocol implementation across multiple Fortinet appliances, enabling Man-in-the-Middle (MitM) attackers to forge authentication responses and gain unauthorized access.
Description
Technical context and vulnerability details
The RADIUS protocol is widely used in enterprise networks to handle centralized authentication for VPNs, wireless networks, and administrative logins on Fortinet solutions.
These products are affected by the following vulnerabilities:
CVE-2024-3596: MD5 collision vulnerability in the RADIUS Access-Request validation protocol (CWE-328), allowing an on-path attacker to forge authentication responses without knowing the shared secret. Classified Critical with a CVSS v3.1 base score of 9.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Forgery of Access-Accept responses by network-adjacent MitM attackers;
- Unauthorized administrative and VPN access bypassing credential validation;
- Compromise of user sessions utilizing non-EAP RADIUS authentication.
Affected systems
Products, components and targeted versions
- FortiOS: all versions prior to 7.4.5, 7.2.9, and 7.0.16;
- FortiProxy: all versions prior to 7.4.1 and 7.2.7;
- FortiAuthenticator: all versions prior to 6.6.0.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Apply latest firmware updates enabling Message-Authenticator attribute validation for all RADIUS requests;
- Require RADIUS over TLS (RadSec) where supported;
- Isolate RADIUS communication onto dedicated, encrypted VLANs or management networks.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.