// For flags

CVE-2024-3661

DHCP routing options can manipulate interface-based VPN traffic

Severity Score

2.1
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Por diseño, el protocolo DHCP no autentica mensajes, incluida, por ejemplo, la opción de ruta estática sin clases (121). Un atacante con la capacidad de enviar mensajes DHCP puede manipular rutas para redirigir el tráfico VPN, lo que le permite leer, interrumpir o posiblemente modificar el tráfico de red que se esperaba que estuviera protegido por la VPN. Muchos, si no la mayoría, de los sistemas VPN basados en enrutamiento IP son susceptibles a este tipo de ataques.

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic expected to be protected by the VPN.

Security and bug fixes for NetworkManager.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
Passive
System
Vulnerable | Subsequent
Confidentiality
Low
None
Integrity
Low
None
Availability
Low
None
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-11 CVE Reserved
  • 2024-05-06 CVE Published
  • 2024-05-29 First Exploit
  • 2024-08-28 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-306: Missing Authentication for Critical Function
  • CWE-501: Trust Boundary Violation
CAPEC
References (23)
URL Tag Source
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose
https://bst.cisco.com/quickview/bug/CSCwk05814
https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://fortiguard.fortinet.com/psirt/FG-IR-24-170
https://issuetracker.google.com/issues/263721377
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://my.f5.com/manage/s/article/K000139553
https://news.ycombinator.com/item?id=40279632
https://news.ycombinator.com/item?id=40284111
https://security.paloaltonetworks.com/CVE-2024-3661
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661
https://tunnelvisionbug.com
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.leviathansecurity.com/research/tunnelvision
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability
URL Date SRC
https://github.com/a1xbit/DecloakingVPN 2024-05-29
URL Date SRC
URL Date SRC
https://access.redhat.com/security/cve/CVE-2024-3661 2025-01-16
https://bugzilla.redhat.com/show_bug.cgi?id=2320141 2025-01-16
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
IETF
Search vendor "IETF"
 DHCP
Search vendor "IETF" for product "DHCP"
 0
Search vendor "IETF" for product "DHCP" and version "0"
en
Affected