DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
History
15 Jan 2025, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux
Citrix secure Access Client F5 big-ip Access Policy Manager F5 Apple macos Apple Cisco secure Client Watchguard ipsec Mobile Vpn Client Cisco anyconnect Vpn Client Fortinet forticlient Paloaltonetworks Paloaltonetworks globalprotect Zscaler client Connector Cisco Watchguard Fortinet Linux linux Kernel Watchguard mobile Vpn With Ssl Zscaler Apple iphone Os Citrix |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
| CWE | CWE-306 | |
| References | () https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 - Vendor Advisory | |
| References | () https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ - Press/Media Coverage | |
| References | () https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability - Exploit, Third Party Advisory | |
| References | () https://my.f5.com/manage/s/article/K000139553 - Vendor Advisory | |
| References | () https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic - Issue Tracking | |
| References | () https://news.ycombinator.com/item?id=40284111 - Issue Tracking | |
| References | () https://datatracker.ietf.org/doc/html/rfc2131#section-7 - Related | |
| References | () https://tunnelvisionbug.com/ - Exploit, Third Party Advisory | |
| References | () https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ - Press/Media Coverage | |
| References | () https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision - Third Party Advisory | |
| References | () https://issuetracker.google.com/issues/263721377 - Issue Tracking | |
| References | () https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ - Press/Media Coverage | |
| References | () https://datatracker.ietf.org/doc/html/rfc3442#section-7 - Related | |
| References | () https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 - Mitigation, Third Party Advisory | |
| References | () https://www.agwa.name/blog/post/hardening_openvpn_for_def_con - Related | |
| References | () https://security.paloaltonetworks.com/CVE-2024-3661 - Vendor Advisory | |
| References | () https://www.leviathansecurity.com/research/tunnelvision - Third Party Advisory | |
| References | () https://bst.cisco.com/quickview/bug/CSCwk05814 - Vendor Advisory | |
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-24-170 - Vendor Advisory | |
| References | () https://news.ycombinator.com/item?id=40279632 - Issue Tracking | |
| CPE | cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:macos:*:* cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:macos:*:* cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:* cpe:2.3:a:zscaler:client_connector:-:*:*:*:*:windows:*:* cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:* cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:* cpe:2.3:a:cisco:secure_client:-:*:*:*:*:*:*:* cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:windows:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:* cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:* cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:* cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:a:cisco:anyconnect_vpn_client:-:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:* cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:* cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:* cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:* cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:* cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:linux:*:* |
01 Jul 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 May 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 May 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. |
07 May 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 May 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 May 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
06 May 2024, 19:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-06 19:15
Updated : 2025-01-15 16:50
NVD link : CVE-2024-3661
Mitre link : CVE-2024-3661
JSON object : View
Products Affected
cisco
- anyconnect_vpn_client
- secure_client
watchguard
- ipsec_mobile_vpn_client
- mobile_vpn_with_ssl
zscaler
- client_connector
paloaltonetworks
- globalprotect
f5
- big-ip_access_policy_manager
apple
- macos
- iphone_os
fortinet
- forticlient
citrix
- secure_access_client
linux
- linux_kernel
CWE
CWE-306
Missing Authentication for Critical Function