CVE-2006-1354
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass...
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
CVE-2006-1354- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
CVE-2006-1354- Updated
- 2026-11-02
EUVDEUVD-2006-1358 No score
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
EUVD-2006-1358- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-778m-hp9h-2cxq No score
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass...
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
GHSA-778m-hp9h-2cxq- Updated
- 2026-11-02
OSV No score
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
CVE-2006-1354- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1354 No score
Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.
- Record
DEBIAN-CVE-2006-1354- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeradiusDebian:12 |
before 1.1.0-1.2 | 1.1.0-1.2 |
freeradiusDebian:13 |
before 1.1.0-1.2 | 1.1.0-1.2 |
freeradiusDebian:14 |
before 1.1.0-1.2 | 1.1.0-1.2 |
freeradiusDebian:3.1 From an advisory covering 2 CVEs |
before 1.0.2-4sarge1, plus listed versions 1.0.2-4 |
1.0.2-4sarge1 |
freeradiusRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.0.1-2.RHEL3.2 | 0:1.0.1-2.RHEL3.2 |
freeradius-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.0.1-2.RHEL3.2 | 0:1.0.1-2.RHEL3.2 |
freeradiusRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.0.1-2.RHEL3.2 | 0:1.0.1-2.RHEL3.2 |
freeradius-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.0.1-2.RHEL3.2 | 0:1.0.1-2.RHEL3.2 |
freeradiusRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freeradius-mysqlRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-postgresqlRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-unixODBCRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradiusRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-mysqlRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-postgresqlRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
freeradius-unixODBCRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.0.1-3.RHEL4.3 | 0:1.0.1-3.RHEL4.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1354 is a high vulnerability (CVSS 7.5) in Freeradius, published March 22, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in freeradius 1.1.0-1.2.
References
gentoo.org/security/en/glsa/glsa-200604-03.xml
exchange.xforce.ibmcloud.com/vulnerabilities/25352
secunia.com/advisories/19300
lists.suse.de/archive/suse-security-announce/2006-Mar/0009.html
securityfocus.com/bid/17171
Show 27 moreShow less
vupen.com/english/advisories/2006/1016
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10156
freeradius.org/security.html
debian.org/security/2006/dsa-1089
securitytracker.com/id?1015795
rhn.redhat.com/errata/RHSA-2006-0271.html
trustix.org/errata/2006/0020
mandriva.com/security/advisories?name=MDKSA-2006:060
nvd.nist.gov/vuln/detail/CVE-2006-1354
github.com/advisories/GHSA-778m-hp9h-2cxq
security-tracker.debian.org/tracker/CVE-2006-1354
access.redhat.com/errata/RHSA-2006:0271
bugzilla.redhat.com/show_bug.cgi?id=167676
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0271.json
cve.org/CVERecord?id=CVE-2005-4744