CVE-2024-3661
Cisco DHCP Route Leak
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
INFO
Published Date :
May 6, 2024, 7:15 p.m.
Last Modified :
Jan. 15, 2025, 4:50 p.m.
Source :
9119a7d8-5eab-497f-8521-727c672e3725
Remotely Exploitable :
No
Impact Score :
4.7
Exploitability Score :
2.8
Public PoC/Exploit Available at Github
CVE-2024-3661 has a 6 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2024-3661
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-3661.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Files to accompany: How TunnelVision Can Bypass Your VPN and Break the Internet: Vulnerability Explained
cve cyber cybersecurity dhcp vpn
Manipulate VPN Traffic on a Local Network
localnetwork vpn wireshark virtual-machine virtualbox cve-2024-3661 popos ubuntu-server windows-10 protonvpn
None
Python Shell
A network technique that decloaks a VPN users traffic on a local network without disconnecting them from a VPN.
Shell
SecDB
The security tool(project) Set from github。github安全项目工具集合
Perl Shell
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-3661 vulnerability anywhere in the article.
-
Cybersecurity News
GL-iNet Routers Exposed to Critical Vulnerabilities: Urgent Firmware Updates Required
GL-iNet has recently issued a security advisory addressing multiple critical vulnerabilities in several of their router models. The vulnerabilities, tracked under CVE-2024-39225 through CVE-2024-39229 ... Read more
The following table lists the changes that have been made to the
CVE-2024-3661 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 15, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Added CWE NIST CWE-306 Added CPE Configuration AND OR *cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:* versions up to (excluding) 24.06.1 OR cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Added CPE Configuration AND OR *cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:* versions up to (excluding) 24.8.5 OR cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:cisco:anyconnect_vpn_client:-:*:*:*:*:*:*:* *cpe:2.3:a:cisco:secure_client:-:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 7.2.3 up to (including) 7.2.5 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (including) 15.1.10 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (including) 16.1.5 *cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (including) 17.1.2 Added CPE Configuration OR *cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5 *cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5 *cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5 *cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:linux:*:* *cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:* *cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:* Added CPE Configuration OR *cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:* *cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:* *cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:* *cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:* Added CPE Configuration OR *cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:macos:*:* *cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:windows:*:* *cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:macos:*:* *cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:* Added CPE Configuration OR *cpe:2.3:a:zscaler:client_connector:-:*:*:*:*:windows:*:* *cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:* versions up to (excluding) 1.5.1.25 *cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:* versions from (including) 3.7 up to (excluding) 3.7.0.134 *cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:* versions up to (excluding) 4.2.0.282 Changed Reference Type https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ No Types Assigned https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage Changed Reference Type https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ No Types Assigned https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage Changed Reference Type https://bst.cisco.com/quickview/bug/CSCwk05814 No Types Assigned https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory Changed Reference Type https://bst.cisco.com/quickview/bug/CSCwk05814 No Types Assigned https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory Changed Reference Type https://datatracker.ietf.org/doc/html/rfc2131#section-7 No Types Assigned https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related Changed Reference Type https://datatracker.ietf.org/doc/html/rfc2131#section-7 No Types Assigned https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related Changed Reference Type https://datatracker.ietf.org/doc/html/rfc3442#section-7 No Types Assigned https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related Changed Reference Type https://datatracker.ietf.org/doc/html/rfc3442#section-7 No Types Assigned https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related Changed Reference Type https://fortiguard.fortinet.com/psirt/FG-IR-24-170 No Types Assigned https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory Changed Reference Type https://fortiguard.fortinet.com/psirt/FG-IR-24-170 No Types Assigned https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory Changed Reference Type https://issuetracker.google.com/issues/263721377 No Types Assigned https://issuetracker.google.com/issues/263721377 Issue Tracking Changed Reference Type https://issuetracker.google.com/issues/263721377 No Types Assigned https://issuetracker.google.com/issues/263721377 Issue Tracking Changed Reference Type https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ No Types Assigned https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage Changed Reference Type https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ No Types Assigned https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage Changed Reference Type https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic No Types Assigned https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking Changed Reference Type https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic No Types Assigned https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking Changed Reference Type https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision No Types Assigned https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory Changed Reference Type https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision No Types Assigned https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory Changed Reference Type https://my.f5.com/manage/s/article/K000139553 No Types Assigned https://my.f5.com/manage/s/article/K000139553 Vendor Advisory Changed Reference Type https://my.f5.com/manage/s/article/K000139553 No Types Assigned https://my.f5.com/manage/s/article/K000139553 Vendor Advisory Changed Reference Type https://news.ycombinator.com/item?id=40279632 No Types Assigned https://news.ycombinator.com/item?id=40279632 Issue Tracking Changed Reference Type https://news.ycombinator.com/item?id=40279632 No Types Assigned https://news.ycombinator.com/item?id=40279632 Issue Tracking Changed Reference Type https://news.ycombinator.com/item?id=40284111 No Types Assigned https://news.ycombinator.com/item?id=40284111 Issue Tracking Changed Reference Type https://news.ycombinator.com/item?id=40284111 No Types Assigned https://news.ycombinator.com/item?id=40284111 Issue Tracking Changed Reference Type https://security.paloaltonetworks.com/CVE-2024-3661 No Types Assigned https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory Changed Reference Type https://security.paloaltonetworks.com/CVE-2024-3661 No Types Assigned https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory Changed Reference Type https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 No Types Assigned https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory Changed Reference Type https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 No Types Assigned https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory Changed Reference Type https://tunnelvisionbug.com/ No Types Assigned https://tunnelvisionbug.com/ Exploit, Third Party Advisory Changed Reference Type https://tunnelvisionbug.com/ No Types Assigned https://tunnelvisionbug.com/ Exploit, Third Party Advisory Changed Reference Type https://www.agwa.name/blog/post/hardening_openvpn_for_def_con No Types Assigned https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related Changed Reference Type https://www.agwa.name/blog/post/hardening_openvpn_for_def_con No Types Assigned https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related Changed Reference Type https://www.leviathansecurity.com/research/tunnelvision No Types Assigned https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory Changed Reference Type https://www.leviathansecurity.com/research/tunnelvision No Types Assigned https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory Changed Reference Type https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ No Types Assigned https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage Changed Reference Type https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ No Types Assigned https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage Changed Reference Type https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 No Types Assigned https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Vendor Advisory Changed Reference Type https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 No Types Assigned https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Vendor Advisory Changed Reference Type https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability No Types Assigned https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Vendor Advisory Changed Reference Type https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability No Types Assigned https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Vendor Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Added Reference https://bst.cisco.com/quickview/bug/CSCwk05814 Added Reference https://datatracker.ietf.org/doc/html/rfc2131#section-7 Added Reference https://datatracker.ietf.org/doc/html/rfc3442#section-7 Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Added Reference https://issuetracker.google.com/issues/263721377 Added Reference https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Added Reference https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Added Reference https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Added Reference https://my.f5.com/manage/s/article/K000139553 Added Reference https://news.ycombinator.com/item?id=40279632 Added Reference https://news.ycombinator.com/item?id=40284111 Added Reference https://security.paloaltonetworks.com/CVE-2024-3661 Added Reference https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Added Reference https://tunnelvisionbug.com/ Added Reference https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Added Reference https://www.leviathansecurity.com/research/tunnelvision Added Reference https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Added Reference https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Added Reference https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
Jul. 01, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://bst.cisco.com/quickview/bug/CSCwk05814 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://security.paloaltonetworks.com/CVE-2024-3661 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://fortiguard.fortinet.com/psirt/FG-IR-24-170 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://my.f5.com/manage/s/article/K000139553 [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 08, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 08, 2024
Action Type Old Value New Value Changed Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40284111 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.agwa.name/blog/post/hardening_openvpn_for_def_con [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://issuetracker.google.com/issues/263721377 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40279632 [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://tunnelvisionbug.com/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/research/tunnelvision [No types assigned] Removed Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision Removed CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L -
CVE Received by 9119a7d8-5eab-497f-8521-727c672e3725
May. 06, 2024
Action Type Old Value New Value Added Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc2131#section-7 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc3442#section-7 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision [No types assigned] Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-306 Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-501 Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-3661 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-3661
weaknesses.