Description

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

INFO

Published Date :

May 6, 2024, 7:15 p.m.

Last Modified :

July 1, 2024, 3:15 p.m.

Source :

9119a7d8-5eab-497f-8521-727c672e3725

Remotely Exploitable :

No

Impact Score :

4.7

Exploitability Score :

2.8
Public PoC/Exploit Available at Github

CVE-2024-3661 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-3661 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

References to Advisories, Solutions, and Tools

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Files to accompany: How TunnelVision Can Bypass Your VPN and Break the Internet: Vulnerability Explained

cve cyber cybersecurity dhcp vpn

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 8, 2024, 11:45 p.m. This repo has been linked 1 different CVEs too.

Manipulate VPN Traffic on a Local Network

localnetwork vpn wireshark virtual-machine virtualbox cve-2024-3661 popos ubuntu-server windows-10 protonvpn

Updated: 4 months, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : May 29, 2024, 12:04 a.m. This repo has been linked 1 different CVEs too.

None

Python Shell

Updated: 2 months ago
1 stars 0 fork 0 watcher
Born at : March 16, 2024, 12:11 a.m. This repo has been linked 1 different CVEs too.

A network technique that decloaks a VPN users traffic on a local network without disconnecting them from a VPN.

Shell

Updated: 2 months, 1 week ago
119 stars 13 fork 13 watcher
Born at : March 11, 2024, 10:24 p.m. This repo has been linked 1 different CVEs too.

SecDB

Updated: 2 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : July 1, 2022, 8:37 p.m. This repo has been linked 82 different CVEs too.

The security tool(project) Set from github。github安全项目工具集合

Perl Shell

Updated: 2 months ago
1240 stars 284 fork 284 watcher
Born at : Feb. 8, 2017, 12:06 p.m. This repo has been linked 10 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-3661 vulnerability anywhere in the article.

  • Cybersecurity News
GL-iNet Routers Exposed to Critical Vulnerabilities: Urgent Firmware Updates Required

GL-iNet has recently issued a security advisory addressing multiple critical vulnerabilities in several of their router models. The vulnerabilities, tracked under CVE-2024-39225 through CVE-2024-39229 ... Read more

Published Date: Aug 11, 2024 (2 months, 3 weeks ago)

The following table lists the changes that have been made to the CVE-2024-3661 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    Jul. 01, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://bst.cisco.com/quickview/bug/CSCwk05814 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://security.paloaltonetworks.com/CVE-2024-3661 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://fortiguard.fortinet.com/psirt/FG-IR-24-170 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://my.f5.com/manage/s/article/K000139553 [No types assigned]
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 08, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ [No types assigned]
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 08, 2024

    Action Type Old Value New Value
    Changed Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 07, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40284111 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.agwa.name/blog/post/hardening_openvpn_for_def_con [No types assigned]
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 07, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://issuetracker.google.com/issues/263721377 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic [No types assigned]
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 07, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://news.ycombinator.com/item?id=40279632 [No types assigned]
  • CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 07, 2024

    Action Type Old Value New Value
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://tunnelvisionbug.com/ [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/research/tunnelvision [No types assigned]
    Removed Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision
    Removed CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
    Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
  • CVE Received by 9119a7d8-5eab-497f-8521-727c672e3725

    May. 06, 2024

    Action Type Old Value New Value
    Added Description By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks.
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc2131#section-7 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://datatracker.ietf.org/doc/html/rfc3442#section-7 [No types assigned]
    Added Reference Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government https://www.leviathansecurity.com/blog/tunnelvision [No types assigned]
    Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-306
    Added CWE Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government CWE-501
    Added CVSS V3.1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-3661 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability