PAP transmits credentials in cleartext, so the password itself is exposed if traffic is intercepted or sent over an untrusted path. Pairing PAP with MFA reduces the blast radius, but it does not make plaintext transport safe on its own. Teams should compensate with encrypted transport, careful segmentation, and tight control of the shared secret used by the RADIUS flow.
Why PAP raises the exposure of remote admin sessions
PAP is risky in remote administrative access because it sends the password itself, not a verifier, over the path used for authentication. If the traffic can be observed, relayed, or routed through an untrusted segment, the credential is exposed directly and can be reused against the admin target or other systems that accept the same secret.
That changes the trust model of the whole remote login flow. Instead of protecting a secret while it is in transit, PAP assumes the path is already sufficiently safe, which is a weak assumption for administrator access where compromise impact is high and the same shared secret may unlock multiple devices or services.
In practice, the risk is amplified when PAP is used over remote links that are not strongly encrypted end to end. The password is only one part of the problem: the RADIUS shared secret, any bridging hop, and any device or proxy that terminates the session also become part of the attack surface.
How PAP and RADIUS interact in an administrative path
RADIUS can support access decisions and central policy, but PAP is still a cleartext password transport method at the protocol edge. The protocol can authenticate the user to the remote service, yet it does not by itself provide confidentiality for the credential on the wire. That is why PAP becomes much less defensible when it is paired with remote administrative access rather than a tightly controlled internal segment.
A practical way to think about it is this: RADIUS centralizes the decision, but PAP exposes the secret. If the remote admin workflow depends on a password being visible to anything between the user and the authenticator, the design is already assuming the transport layer, the network boundary, and the device path are all trustworthy.
For that reason, teams usually treat stronger transport protection, segmentation, and session handling as part of the control set, not optional hardening. Privileged Session Management Guide is useful here because admin access is not just about login success, it is also about limiting what a successful session can do and how well it is observed.
Where the remote path reaches sensitive infrastructure, the shared secret used by the RADIUS flow also matters. If that secret is weak, reused, or broadly distributed, compromise of one endpoint or intermediary can turn one login exposure into a wider administrative foothold.
What actually fails when PAP is used remotely
The main failure is credential exposure, but the secondary failure is blast radius. Once a password is captured, the attacker does not need to defeat the authentication method again; they can often authenticate directly, reuse the password elsewhere, or pivot into a privileged management plane if the same secret or account is shared across systems.
That is why this pattern is especially dangerous for remote admin access: the session is already close to the crown jewels. If an attacker can observe a PAP exchange or recover the password from any intermediary, the control that was meant to establish trust can become the source of compromise.
Change Healthcare breach 2024 illustrates the broader lesson that a single weak remote access control can be enough to trigger major enterprise impact when the entry point is privileged and the session is not well defended.
Risk and Threat Considerations
Remote administrative access concentrates privilege, so any cleartext credential path materially increases the chance that a captured password becomes an immediate administrative compromise. The danger is not just interception in transit, but also replay, reuse, and lateral movement after the initial capture.
Failure mechanism: PAP reveals the password itself during authentication, so any party that can inspect the traffic or reach the termination path may obtain a reusable secret.
Impact: Attackers can authenticate as the administrator, reuse the credential on other services, or exploit the same shared secret to widen access across the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | PAP remote access depends on password lifecycle and secret handling. |
| IA-9 — Service Identification and Authentication | RADIUS-backed remote admin flows often involve non-human endpoints or services in the trust path. | |
| Recommendation — Restrict, rotate, and protect authenticators used in remote administrative access. Authenticate remote services and endpoints with stronger mechanisms than shared passwords. | ||
| ISO/IEC 27001:2022 | A.8.5 — Secure authentication | Cleartext password transport directly concerns authentication security. |
| A.8.24 — Use of cryptography | Encrypted transport is the key compensation for PAP exposure risk. | |
| Recommendation — Require authentication methods that do not expose credentials in transit. Protect remote admin authentication traffic with cryptographic transport controls. | ||
| CIS Controls v8 | CIS-5 — Account Management | Remote admin access risk rises when privileged accounts and shared secrets are not tightly governed. |
| Recommendation — Inventory, restrict, and control privileged accounts used for remote access. | ||
| MITRE ATT&CK | T1021 — Remote Services | PAP over RADIUS is a remote service access path that attackers target for credential abuse. |
| T1552 — Unsecured Credentials | PAP exposes credentials in transit, matching unsecured credential abuse patterns. | |
| Recommendation — Monitor remote service access for credential capture and unauthorized administrative use. Detect and eliminate places where credentials can be recovered from transport or configuration. | ||
Practitioner Guidance
What to verify: Confirm whether PAP is still in use anywhere remote admin access is exposed, and verify whether the transport is protected in a way that prevents credential disclosure rather than merely hiding it from casual observation. If the answer depends on a weak network assumption, treat it as a design issue, not a configuration tweak.
What to prioritise: Eliminate plaintext password transport for administrative paths first, then reduce the scope and lifespan of any shared secret that remains part of the RADIUS flow. If a password can unlock privileged access from a remote location, the default assumption should be that it needs stronger transport and tighter containment.
Practitioner takeaway: PAP is tolerable only when the transport is already trustworthy, and that is a poor assumption for remote admin. The control objective is to stop credential exposure before it becomes privileged access, not to rely on MFA alone after the secret has already travelled in cleartext.
Related resources from NHI Mgmt Group
- Why does using remote control software for telework increase security risk compared with purpose-built remote access?
- Why does using a traditional VPN increase risk in remote access environments?
- Why do ephemeral credentials still leave risk in machine access models?
- Why does remote vendor access increase risk in industrial environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
