Firmware 3.4.1.3 Point Release for G5 PDU – Blast-RADIUS Vulnerability Fix

Contents 

1. Introduction
2. Purpose
3. Requirements
4. Procedure

Introduction 

Firmware version 3.4.1.3 for the Panduit G5 PDU is a security-focused point release that addresses the Blast-RADIUS (CVE-2024-3596) vulnerability affecting RADIUS authentication communications.
 

Purpose

To provide details regarding the changes introduced in G5 PDU firmware version 3.4.1.3 and the validation performed to verify the Blast-RADIUS security mitigation.

Requirements

Below is the test environment used to validate the Blast-RADIUS security fix:

• G5 PDU running firmware version 3.4.1.3
• FreeRADIUS server version 3.2.3
• RADIUS authentication enabled on the G5 PDU
• Wireshark packet capture tool
• Test user account configured on the RADIUS server

The FreeRADIUS server was configured to require the Message-Authenticator attribute by enabling the following setting:
require_message_authenticator = yes
 

Procedure 

The following validation steps were performed to verify the Blast-RADIUS mitigation implemented in firmware version 3.4.1.3.

1. Upgraded the G5 PDU to firmware version 3.4.1.3.
2. Configured the G5 PDU to authenticate against the FreeRADIUS server.
3. Enabled packet capture using Wireshark between the G5 PDU and the RADIUS server.
4. Attempted login to the G5 PDU using a valid RADIUS user account.
5. Verified successful authentication through the PDU web interface.
6. Reviewed the FreeRADIUS logs and confirmed that authentication requests were accepted.
7. Inspected the RADIUS Access-Request packet in Wireshark and confirmed the presence of the Message-Authenticator (Attribute 80) field.

8. Confirmed that authentication remained successful with Message-Authenticator enforcement enabled on the RADIUS server.

The G5 PDU successfully authenticated against the FreeRADIUS server while Message-Authenticator enforcement was enabled. Packet captures confirmed that the Access-Request packets contained the Message-Authenticator attribute, demonstrating that firmware version 3.4.1.3 correctly implements the Blast-RADIUS mitigation.

A copy of firmware version 3.4.1.3 and its release notes is attached on this KB article.

If authentication issues are encountered after upgrading to firmware version 3.4.1.3, verify that the RADIUS server supports Message-Authenticator processing and review both server logs and packet capture for troubleshooting.