Executive Summary
In January 2026, Hitachi Energy disclosed a critical vulnerability (CVE-2024-3596) in its FOX61x products, specifically affecting versions R18 and R17A and earlier. This flaw, inherent in the RADIUS protocol under RFC 2865, allows local attackers to modify valid responses through a chosen-prefix collision attack on the MD5 Response Authenticator signature. Exploitation could compromise the confidentiality, integrity, and availability of the affected systems. The vulnerability is particularly relevant when FOX61x devices are configured to use remote RADIUS authentication. (it4automation.com)
This incident underscores the persistent risks associated with legacy authentication protocols and the importance of implementing robust security measures. Organizations utilizing FOX61x devices are urged to apply the recommended mitigations promptly to prevent potential exploitation.
Why This Matters Now
The disclosure of CVE-2024-3596 highlights the critical need for organizations to reassess and strengthen their authentication mechanisms, especially in industrial control systems. With the increasing sophistication of cyber threats targeting infrastructure, timely remediation of such vulnerabilities is essential to maintain operational security and resilience.
Attack Path Analysis
An attacker exploited the RADIUS protocol vulnerability (CVE-2024-3596) in Hitachi Energy FOX61x devices to forge authentication responses, gaining unauthorized access. They escalated privileges by modifying RADIUS responses to grant higher-level access. The attacker moved laterally within the network by accessing other systems authenticated via the compromised RADIUS server. They established command and control by maintaining persistent access through the manipulated authentication system. Sensitive data was exfiltrated by accessing and transferring information from systems authenticated via the compromised RADIUS server. The attack impacted confidentiality, integrity, and availability by allowing unauthorized access and potential data manipulation.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited the RADIUS protocol vulnerability (CVE-2024-3596) in Hitachi Energy FOX61x devices to forge authentication responses, gaining unauthorized access.
Related CVEs
CVE-2024-3596
CVSS 9The RADIUS protocol under RFC 2865 is vulnerable to forgery attacks that allow a local attacker to modify any valid response (Access-Accept, Access-Reject, or Access-Challenge) into another response by exploiting a chosen-prefix collision attack on the MD5 Response Authenticator signature.
Affected Products:
Hitachi Energy FOX61x – <= R17A
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Techniques identified for SEO/filtering; may be expanded with full STIX/TAXII enrichment later.
Use Alternate Authentication Material
Application Access Token
Pass the Hash
Pass the Ticket
Web Session Cookie
Adversary-in-the-Middle
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Cryptography for Authentication
Control ID: 8.2.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Critical vulnerability in Hitachi Energy FOX61x RADIUS authentication affects power grid control systems, enabling forgery attacks compromising operational technology security.
Oil/Energy/Solar/Greentech
Energy sector infrastructure using FOX61x devices faces high-severity authentication bypass risks, potentially disrupting critical energy production and distribution operations.
Critical Manufacturing
Manufacturing control systems vulnerable to MD5 collision attacks through compromised RADIUS authentication, risking production integrity and operational availability disruptions.
Government Administration
Government critical infrastructure dependent on FOX61x industrial control systems exposed to network-based authentication forgery attacks with confidentiality implications.
Sources
- Hitachi Energy FOX61xhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-036-06Verified
- CVE-2024-3596 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2024-3596Verified
- Hitachi Energy Cybersecurity Trust Centerhttps://www.hitachienergy.com/products-and-solutions/cybersecurity/cybersecurity-trust-centerVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely reduce the attacker's ability to exploit authentication vulnerabilities and limit unauthorized lateral movement within the network.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit authentication vulnerabilities would likely be constrained, reducing the risk of unauthorized access.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, reducing the risk of unauthorized access to sensitive systems.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the risk of widespread compromise.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to maintain persistent access would likely be constrained, reducing the risk of prolonged unauthorized control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, reducing the risk of data loss.
The attacker's ability to compromise confidentiality, integrity, and availability would likely be constrained, reducing the overall impact of the attack.
Impact at a Glance
Affected Business Functions
- Network Authentication Services
- Remote Access Management
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of authentication credentials and unauthorized access to network resources.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Encrypted Traffic (HPE) to secure data in transit and prevent unauthorized access.
- • Deploy Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Utilize East-West Traffic Security to monitor and control internal network communications.
- • Establish Multicloud Visibility & Control to detect and respond to anomalous activities across environments.
- • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
