CVEvulnerability
CVE-2024-3661
7.6 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2024-05-06
- Last modified
- 2026-06-17
- Assigner
- 9119a7d8-5eab-497f-8521-727c672e3725
- CVSS 3.1 (9119a7d8-5eab-497f-8521-727c672e3725)
- 7.6 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- CVSS 3.1 ([email protected])
- 7.6 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Weaknesses
- CWE-306, CWE-501
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Affected configurations
• fortinet forticlient (>= 6.4.0 < 7.2.5)
• fortinet forticlient 7.4.0
• cisco anyconnect vpn client
• cisco secure client
• paloaltonetworks globalprotect
• citrix secure access client (< 24.06.1)
• citrix secure access client (< 24.8.5)
• f5 big-ip access policy manager (>= 7.2.3 <= 7.2.5)
• f5 big-ip access policy manager (>= 15.1.0 <= 15.1.10)
• f5 big-ip access policy manager (>= 16.1.0 <= 16.1.5)
• f5 big-ip access policy manager (>= 17.1.0 <= 17.1.2)
• watchguard ipsec mobile vpn client
• watchguard mobile vpn with ssl
• zscaler client connector (< 1.5.1.25)
• zscaler client connector (< 4.2.0.282)
• zscaler client connector (>= 3.7 < 3.7.0.134)
• zscaler client connector
Related
References
- https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage
- https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory, Vendor Advisory
- https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related
- https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related
- https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory
- https://issuetracker.google.com/issues/263721377 Issue Tracking
- https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage
- https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking
- https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory
- https://my.f5.com/manage/s/article/K000139553 Vendor Advisory
- https://news.ycombinator.com/item?id=40279632 Issue Tracking
- https://news.ycombinator.com/item?id=40284111 Issue Tracking
- https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory
- https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory
- https://tunnelvisionbug.com/ Exploit, Third Party Advisory
- https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related
- https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory
- https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Third Party Advisory, Vendor Advisory
- https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Third Party Advisory, Vendor Advisory
- https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage
- https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory, Vendor Advisory
- https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related
- https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related
- https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory
- https://issuetracker.google.com/issues/263721377 Issue Tracking
- https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage
- https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking
- https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory
- https://my.f5.com/manage/s/article/K000139553 Vendor Advisory
- https://news.ycombinator.com/item?id=40279632 Issue Tracking
- https://news.ycombinator.com/item?id=40284111 Issue Tracking
- https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory
- https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory
- https://tunnelvisionbug.com/ Exploit, Third Party Advisory
- https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related
- https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory
- https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Third Party Advisory, Vendor Advisory
- https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Third Party Advisory, Vendor Advisory