cve.bz

CVE-2017-9148

9.8 criticalEPSS 3.9%

Critical (9.8) in freeradius freeradius. EPSS 3.9% chance of exploitation in the next 30 days.

The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

Severity

CVSS 3.0

9.8 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON