# Schneider switches vulnerable to RADIUS forgery attacks

Published: 2026-06-09 · Severity: medium · Sectors: energy, government-national, transportation, infrastructure
Canonical: https://vorant.io/reports/c53aad06-87e3-48c3-a709-918a4174bfff/schneider-switches-vulnerable-to-radius-forgery-attacks

> A RADIUS protocol flaw in Schneider Electric Modicon managed switches allows forgery attacks when Message Authenticator is disabled, risking denial of service and data integrity loss.

Schneider Electric disclosed CVE-2024-3596, a RADIUS protocol vulnerability affecting all versions of its Modicon Network Managed Switches, Connexium Managed Switches, and Modicon Redundancy Switches. The vulnerability enables forgery attacks against RADIUS authentication responses, potentially allowing attackers to modify Access-Accept, Access-Reject, or Access-Challenge messages. Successful exploitation could result in denial of service conditions and compromise the confidentiality and integrity of devices connected to affected switches.

The flaw stems from improper enforcement of message integrity during transmission and only manifests when the RADIUS Server Message Authenticator option is disabled from its secure default state. The vulnerability affects critical infrastructure across commercial facilities, energy, food and agriculture, government, transportation, and water sectors deployed globally. Schneider Electric emphasizes that default configurations are not vulnerable, as the Message Authenticator option is enabled by default.

Schneider Electric recommends organizations maintain the default RADIUS configuration with Message Authenticator enabled. For affected products, the setting can be verified and configured via CLI commands or SNMP MIB parameters specific to each product line. CISA reinforces standard ICS security practices including network isolation, firewall deployment, secure remote access via updated VPNs, and defense-in-depth strategies for industrial control systems.

## Mentioned in this report

- Vulnerabilities: CVE-2024-3596

## Detection guidance (public sample)

### RADIUS Response Without Message-Authenticator Attribute (CVE-2024-3596 Exposure)

ATT&CK: T1557

Detects RADIUS Access-Accept/Access-Reject/Access-Challenge responses that lack the Message-Authenticator attribute, the condition required for Blast-RADIUS style forgery attacks against Schneider Electric managed switches. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RADIUS Response Without Message-Authenticator Attribute
id: 8b4cb846-ee9c-5237-be66-00e37b7633b6
status: experimental
description: 'Identifies RADIUS Access-Accept, Access-Reject, or Access-Challenge
  messages observed on the network that do not carry a Message-Authenticator attribute.
  CVE-2024-3596 (Blast-RADIUS) forgery attacks against Schneider Electric Modicon
  and Connexium switches are only possible when this attribute is missing/disabled,
  so its absence on live authentication traffic is a strong signal that the device
  is in a vulnerable, non-default configuration and potentially under active AiTM
  manipulation.

  '
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
  category: network_connection
  product: zeek
  service: radius
detection:
  selection:
    radius.code:
    - Access-Accept
    - Access-Reject
    - Access-Challenge
  filter:
    radius.message_authenticator_present: true
  condition: selection and not filter
fields:
- id.orig_h
- id.resp_h
- radius.code
- radius.username
falsepositives:
- Legacy RADIUS servers or NAS devices intentionally configured without Message-Authenticator
  for compatibility reasons
- Network taps or monitoring tools that do not fully parse/report the Message-Authenticator
  attribute, producing false negatives on the field
level: high
tags:
- attack.t1557
- cve.2024-3596
author: Vorant
```

### Multiple Conflicting RADIUS Responses for Single Authentication Request

ATT&CK: T1498

Detects more than one RADIUS response (Access-Accept/Reject/Challenge) observed for the same authentication transaction identifier, indicative of response forgery/injection or a resulting denial-of-service against RADIUS-authenticated switch management sessions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Multiple Conflicting RADIUS Responses For Same Transaction
id: 0a200c69-52f5-590c-acff-6cbbe45b86b0
status: experimental
description: 'Flags RADIUS traffic where a client-visible authentication transaction
  (matched by trans_id/session identifiers) receives more than one Access-Accept/Access-Reject/Access-Challenge
  response. Legitimate RADIUS exchanges produce exactly one final response per request;
  duplicate or conflicting responses are consistent with forged/injected RADIUS packets
  exploiting CVE-2024-3596 to disrupt or hijack authentication on Schneider Electric
  managed switches, potentially causing denial of service or unauthorized access decisions.
  Aggregation/count logic for duplicate detection should be implemented in the SIEM
  correlation layer (e.g. count of distinct radius.code per trans_id > 1 within the
  session lifetime) rather than encoded here.

  '
references:
- https://www.cisa.gov/news-events/ics-advisories
logsource:
  category: network_connection
  product: zeek
  service: radius
detection:
  selection:
    radius.code:
    - Access-Accept
    - Access-Reject
    - Access-Challenge
  condition: selection
fields:
- id.orig_h
- id.resp_h
- radius.trans_id
- radius.code
falsepositives:
- Network retransmissions caused by packet loss on unreliable links between switch
  and RADIUS server
- Load-balanced or redundant RADIUS servers responding to the same forwarded request
  under normal high-availability configurations
level: medium
tags:
- attack.t1498
- cve.2024-3596
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-160-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c53aad06-87e3-48c3-a709-918a4174bfff/schneider-switches-vulnerable-to-radius-forgery-attacks.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup