CVE-2024-3661

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

HCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

References

Link	Resource
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/	Press/Media Coverage
https://bst.cisco.com/quickview/bug/CSCwk05814	Vendor Advisory
https://datatracker.ietf.org/doc/html/rfc2131#section-7	Related
https://datatracker.ietf.org/doc/html/rfc3442#section-7	Related
https://fortiguard.fortinet.com/psirt/FG-IR-24-170	Vendor Advisory
https://issuetracker.google.com/issues/263721377	Issue Tracking
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/	Press/Media Coverage
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic	Issue Tracking
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision	Third Party Advisory
https://my.f5.com/manage/s/article/K000139553	Vendor Advisory
https://news.ycombinator.com/item?id=40279632	Issue Tracking
https://news.ycombinator.com/item?id=40284111	Issue Tracking
https://security.paloaltonetworks.com/CVE-2024-3661	Vendor Advisory
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661	Vendor Advisory
https://tunnelvisionbug.com/	Exploit Third Party Advisory
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con	Related
https://www.leviathansecurity.com/research/tunnelvision	Third Party Advisory
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/	Press/Media Coverage
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009	Mitigation Third Party Advisory
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability	Exploit Third Party Advisory
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/	Exploit Press/Media Coverage
https://bst.cisco.com/quickview/bug/CSCwk05814	Third Party Advisory
https://datatracker.ietf.org/doc/html/rfc2131#section-7	Related
https://datatracker.ietf.org/doc/html/rfc3442#section-7	Related
https://fortiguard.fortinet.com/psirt/FG-IR-24-170	Vendor Advisory
https://issuetracker.google.com/issues/263721377	Issue Tracking
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/	Exploit Press/Media Coverage
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic	Issue Tracking
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision	Third Party Advisory
https://my.f5.com/manage/s/article/K000139553	Vendor Advisory
https://news.ycombinator.com/item?id=40279632	Issue Tracking
https://news.ycombinator.com/item?id=40284111	Issue Tracking
https://security.paloaltonetworks.com/CVE-2024-3661	Vendor Advisory
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661	Vendor Advisory
https://tunnelvisionbug.com/	Exploit Third Party Advisory
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con	Related
https://www.leviathansecurity.com/research/tunnelvision	Third Party Advisory
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/	Exploit Press/Media Coverage
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009	Mitigation Vendor Advisory
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:forticlient::::::linux::*
	cpe:2.3:a:fortinet:forticlient::::::macos::*
	cpe:2.3:a:fortinet:forticlient::::::windows::*
	cpe:2.3:a:fortinet:forticlient:7.4.0:::::linux::
	cpe:2.3:a:fortinet:forticlient:7.4.0:::::macos::
	cpe:2.3:a:fortinet:forticlient:7.4.0:::::windows::

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:anyconnect_vpn_client:-:::::::*
	cpe:2.3:a:cisco:secure_client:-:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:paloaltonetworks:globalprotect::::::iphone_os::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::linux::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::*
	cpe:2.3:a:paloaltonetworks:globalprotect::::::windows::*

Configuration 4 (hide)

AND

cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:iphone_os:-:::::::*
	cpe:2.3:o:apple:macos:-:::::::*

Configuration 5 (hide)

AND

cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 6 (hide)

OR	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::

Configuration 7 (hide)

OR	cpe:2.3:a:watchguard:ipsec_mobile_vpn_client::::::macos::*
	cpe:2.3:a:watchguard:ipsec_mobile_vpn_client::::::windows::*
	cpe:2.3:a:watchguard:mobile_vpn_with_ssl::::::macos::*
	cpe:2.3:a:watchguard:mobile_vpn_with_ssl::::::windows::*

Configuration 8 (hide)

OR	cpe:2.3:a:zscaler:client_connector::::::linux::*
	cpe:2.3:a:zscaler:client_connector::::::macos::*
	cpe:2.3:a:zscaler:client_connector::::::linux::*
	cpe:2.3:a:zscaler:client_connector:-:::::windows::

History

15 Jan 2025, 16:50

21 Nov 2024, 09:30

01 Jul 2024, 15:15

Type	Values Removed	Values Added
References		() https://bst.cisco.com/quickview/bug/CSCwk05814 - () https://fortiguard.fortinet.com/psirt/FG-IR-24-170 - () https://my.f5.com/manage/s/article/K000139553 - () https://security.paloaltonetworks.com/CVE-2024-3661 - () https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 - () https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 -

08 May 2024, 22:15

Type	Values Removed	Values Added
References		() https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ -

08 May 2024, 17:15

Type	Values Removed	Values Added
Summary	(en) By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks.	(en) DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

07 May 2024, 19:15