Executive Summary

CVE-2024-3596 is the Blast-RADIUS protocol flaw, an MD5 chosen-prefix collision attack that lets an on-path adversary forge a valid RADIUS Response (Access-Accept, Access-Reject, or Access-Challenge) without knowing the shared secret, and it affects Schneider Electric Modicon Network Managed Switches used to aggregate Ethernet traffic across control segments. A successful forgery converts an authentication denial into an authentication grant, allowing an unauthorized device or operator to obtain switch administrative access or network entry in plants where these switches gate the controller LAN.

Technical Exposure Breakdown

The defect is in the RADIUS protocol itself, not a coding error unique to Schneider. RADIUS authenticates a Response by computing the MD5 hash over the Response packet, the Request Authenticator, and the shared secret. The Response Authenticator field is the only integrity protection for non-EAP exchanges, and MD5 is broken against chosen-prefix collisions.

An attacker positioned between the RADIUS client (the Modicon switch acting as the NAS) and the RADIUS server can intercept an Access-Request, inject a colliding Proxy-State or other attacker-controlled attribute, and manipulate the server-generated Response so that the MD5 hash still validates. The end state is that a forged Access-Accept passes the switch integrity check. The conditions required are specific: the attacker must sit on the path between the switch and the authentication server, and the exchange must use the legacy UDP transport without Message-Authenticator enforcement. That is precisely the configuration found in most OT deployments, where RADIUS runs unencrypted over a flat management VLAN and RadSec or TLS wrapping is rare.

This is not a remote unauthenticated internet attack. It is a man-in-the-middle attack inside the management plane. In an OT context that distinction matters because the trust boundary is the switch fabric itself, and an attacker who has reached the management VLAN through a compromised engineering workstation or a misconfigured jump host can leverage this to escalate from network presence to authenticated control of the switching layer.

OT Impact and Compliance Risk

If the Modicon switch enforces RADIUS for administrative login or for port-based access control, forgery defeats both. The physical consequence is loss of network segmentation integrity. An adversary who gains switch admin access can mirror traffic to capture controller protocols, modify VLAN assignments to bridge isolated cells, disable port security, or stage further movement toward the PLCs and SCADA nodes the switch serves. None of this is destructive on its own, but it removes the authentication control that separates a contained intrusion from a full process-network compromise.

For compliance, this maps directly to IEC 62443-3-3 requirements SR 1.1 through SR 1.5 on identification and authentication control, and SR 5.1 on network segmentation. NERC CIP-005 and CIP-007 electronic access controls are degraded because the authentication mechanism protecting an Electronic Access Control or Monitoring System can be bypassed. For pipeline operators under TSA SD-02C, the access control and segmentation objectives are similarly weakened. Water utilities subject to AWIA 2018 risk assessments should treat any RADIUS-authenticated managed switch as a now-suspect control.

Compensating Controls

Do not rely on a firmware update alone, and do not active-scan these switches to confirm exposure. Active probing of the management interface on production Modicon hardware can disrupt the switch and the devices behind it, so validate configuration through passive collection and offline review.

BreachSpider tracks exploitation signals and KEV program status for CVE-2024-3596 across the Modicon product line, with passive exposure context tied to your asset inventory.