Read the docs
TI-2013-00271 Aliases CVE-2013-0342GHSA-w4px-9pgm-p2f3

Improper input validation in pyrad

Priority LOW 23CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.

Why it matters now

EPSS 0.01543 75th percentileScored 2026-11-07
Fix Fixed pyrad (pyrad): 2.1pyrad (PyPI): 2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyradpyradbefore 2.12.1Patch availableCNA
—pyrad (PyPI)before 2.12.1Patch availableGHSA-w4px-9pgm-p2f3
  • pyrad Vendorpyrad Affected before 2.1 Fixed in 2.1 Patch available CNA
  • pyrad (PyPI) Vendor— Affected before 2.1 Fixed in 2.1 Patch available GHSA-w4px-9pgm-p2f3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyrad_project:pyrad:*:*:*:*:*:*:*:*before 2.1VulnerablePyrad Project
  • cpe:2.3:a:pyrad_project:pyrad:*:*:*:*:*:*:*:* Versions before 2.1 Vulnerable ·Pyrad Project

Remediation

  • Fix · CNA pyrad (pyrad) Fixed in 2.1
  • Fix · GHSA-w4px-9pgm-p2f3 pyrad (PyPI) Fixed in 2.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0342
  2. 2026-10-03 Alias added: GHSA-w4px-9pgm-p2f3

References

Patch 1

Advisory 5

Other 3

  • TI-2013-00225 packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators… CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences