Vulnerability Report

CVE-2011-2701

Title: Freeradius Auth Bypass

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2011-2701.

CWE Category CWE-287

Published Date Aug 04, 2011

Modified Date Apr 29, 2026

Exploit Status Not Found

Score 5.8 CVSS v2.0

Exploit Probability (EPSS)

0.45%

Vulnerability Summary

CVE-2011-2701: The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.

Impacted Vendors

freeradius 1

Reference Links

http://secunia.com/advisories/45425 http://securityreason.com/securityalert/8325 http://securitytracker.com/id?1025833 http://www.openwall.com/lists/oss-security/2011/07/15/6 http://www.openwall.com/lists/oss-security/2011/07/18/2 http://www.openwall.com/lists/oss-security/2011/07/20/9 http://www.securityfocus.com/archive/1/518974/100/0/threaded http://www.securityfocus.com/bid/48880 https://bugzilla.redhat.com/show_bug.cgi?id=724815 https://exchange.xforce.ibmcloud.com/vulnerabilities/68782 https://www.dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html http://secunia.com/advisories/45425 http://securityreason.com/securityalert/8325 http://securitytracker.com/id?1025833 http://www.openwall.com/lists/oss-security/2011/07/15/6 http://www.openwall.com/lists/oss-security/2011/07/18/2 http://www.openwall.com/lists/oss-security/2011/07/20/9 http://www.securityfocus.com/archive/1/518974/100/0/threaded http://www.securityfocus.com/bid/48880 https://bugzilla.redhat.com/show_bug.cgi?id=724815 https://exchange.xforce.ibmcloud.com/vulnerabilities/68782 https://www.dfn-cert.de/informationen/Sicherheitsbulletins/dsb-2011-01.html

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.8

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2011-2701 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

August 04, 2011 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected Stack

No specific products linked.