CVE-2024-3661
Cisco DHCP Route Leak
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
INFO
Published Date :
May 6, 2024, 7:15 p.m.
Last Modified :
Nov. 21, 2024, 9:30 a.m.
Source :
9119a7d8-5eab-497f-8521-727c672e3725
Remotely Exploitable :
No
Impact Score :
4.7
Exploitability Score :
2.8
Public PoC/Exploit Available at Github
CVE-2024-3661 has a 6 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2024-3661
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-3661.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Files to accompany: How TunnelVision Can Bypass Your VPN and Break the Internet: Vulnerability Explained
cve cyber cybersecurity dhcp vpn
Manipulate VPN Traffic on a Local Network
localnetwork vpn wireshark virtual-machine virtualbox cve-2024-3661 popos ubuntu-server windows-10 protonvpn
None
Python Shell
A network technique that decloaks a VPN users traffic on a local network without disconnecting them from a VPN.
Shell
SecDB
The security tool(project) Set from github。github安全项目工具集合
Perl Shell
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-3661 vulnerability anywhere in the article.
-
Cybersecurity News
GL-iNet Routers Exposed to Critical Vulnerabilities: Urgent Firmware Updates Required
GL-iNet has recently issued a security advisory addressing multiple critical vulnerabilities in several of their router models. The vulnerabilities, tracked under CVE-2024-39225 through CVE-2024-39229 ... Read more
The following table lists the changes that have been made to the
CVE-2024-3661 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Added Reference https://bst.cisco.com/quickview/bug/CSCwk05814 Added Reference https://datatracker.ietf.org/doc/html/rfc2131#section-7 Added Reference https://datatracker.ietf.org/doc/html/rfc3442#section-7 Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Added Reference https://issuetracker.google.com/issues/263721377 Added Reference https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Added Reference https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Added Reference https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Added Reference https://my.f5.com/manage/s/article/K000139553 Added Reference https://news.ycombinator.com/item?id=40279632 Added Reference https://news.ycombinator.com/item?id=40284111 Added Reference https://security.paloaltonetworks.com/CVE-2024-3661 Added Reference https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Added Reference https://tunnelvisionbug.com/ Added Reference https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Added Reference https://www.leviathansecurity.com/research/tunnelvision Added Reference https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Added Reference https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Added Reference https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
Jul. 01, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://bst.cisco.com/quickview/bug/CSCwk05814 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://security.paloaltonetworks.com/CVE-2024-3661 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://fortiguard.fortinet.com/psirt/FG-IR-24-170 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://my.f5.com/manage/s/article/K000139553 [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 08, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 08, 2024
Action Type Old Value New Value Changed Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40284111 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.agwa.name/blog/post/hardening_openvpn_for_def_con [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://issuetracker.google.com/issues/263721377 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40279632 [No types assigned] -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 07, 2024
Action Type Old Value New Value Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://tunnelvisionbug.com/ [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/research/tunnelvision [No types assigned] Removed Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision Removed CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L -
CVE Received by 9119a7d8-5eab-497f-8521-727c672e3725
May. 06, 2024
Action Type Old Value New Value Added Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc2131#section-7 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc3442#section-7 [No types assigned] Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision [No types assigned] Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-306 Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-501 Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-3661 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-3661
weaknesses.