CyberSecBulletin

Freeradius vulnerabilities

We track 2 vulnerabilities in Freeradius products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 17, 2023.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Freeradius vulnerabilities

  • 7.5 High severity

    freeradius: NULL Pointer Dereference

    CVE-2022-41860FreeradiusEPSS 1.21%

    In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer

  • 7.5 High severity

    freeradius: Insufficiently Protected Credentials

    CVE-2022-41859Freeradius

    In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.