Details of VAR-202405-0458

ID

VAR-202405-0458

CVE

CVE-2024-3661

DESCRIPTION

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Trust: 1.0

sources: NVD: CVE-2024-3661

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	7.2.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	zscaler	model:	client connector	scope:	lt	version:	4.2.0.282	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	17.1.2	Trust: 1.0
vendor:	zscaler	model:	client connector	scope:	lt	version:	3.7.0.134	Trust: 1.0
vendor:	watchguard	model:	ipsec mobile vpn client	scope:	eq	version:	*	Trust: 1.0
vendor:	fortinet	model:	forticlient	scope:	eq	version:	7.4.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	17.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	15.1.10	Trust: 1.0
vendor:	paloaltonetworks	model:	globalprotect	scope:	eq	version:	*	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	16.1.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	7.2.3	Trust: 1.0
vendor:	zscaler	model:	client connector	scope:	gte	version:	3.7	Trust: 1.0
vendor:	zscaler	model:	client connector	scope:	lt	version:	1.5.1.25	Trust: 1.0
vendor:	cisco	model:	secure client	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	forticlient	scope:	lt	version:	7.2.5	Trust: 1.0
vendor:	watchguard	model:	mobile vpn with ssl	scope:	eq	version:	*	Trust: 1.0
vendor:	cisco	model:	anyconnect vpn client	scope:	eq	version:	-	Trust: 1.0
vendor:	citrix	model:	secure access client	scope:	lt	version:	24.06.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	16.1.0	Trust: 1.0
vendor:	zscaler	model:	client connector	scope:	eq	version:	-	Trust: 1.0
vendor:	fortinet	model:	forticlient	scope:	gte	version:	6.4.0	Trust: 1.0
vendor:	citrix	model:	secure access client	scope:	lt	version:	24.8.5	Trust: 1.0

sources: NVD: CVE-2024-3661

CVSS

SEVERITY

CVSSV2

CVSSV3

9119a7d8-5eab-497f-8521-727c672e3725:	CVE-2024-3661
value:	HIGH
Trust: 1.0
nvd@nist.gov:	CVE-2024-3661
value:	HIGH
Trust: 1.0

9119a7d8-5eab-497f-8521-727c672e3725:	CVE-2024-3661
baseSeverity:	HIGH
baseScore:	7.6
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	4.7
version:	3.1
Trust: 2.0

sources: NVD: CVE-2024-3661 // NVD: CVE-2024-3661

PROBLEMTYPE DATA

problemtype:	CWE-501	Trust: 1.0
problemtype:	CWE-306	Trust: 1.0

sources: NVD: CVE-2024-3661

EXTERNAL IDS

db:

NVD

id:

CVE-2024-3661

Trust: 1.0

sources: NVD: CVE-2024-3661

REFERENCES

url:	https://datatracker.ietf.org/doc/html/rfc2131#section-7	Trust: 1.0
url:	https://www.leviathansecurity.com/research/tunnelvision	Trust: 1.0
url:	https://news.ycombinator.com/item?id=40284111	Trust: 1.0
url:	https://fortiguard.fortinet.com/psirt/fg-ir-24-170	Trust: 1.0
url:	https://bst.cisco.com/quickview/bug/cscwk05814	Trust: 1.0
url:	https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic	Trust: 1.0
url:	https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision	Trust: 1.0
url:	https://tunnelvisionbug.com/	Trust: 1.0
url:	https://security.paloaltonetworks.com/cve-2024-3661	Trust: 1.0
url:	https://www.agwa.name/blog/post/hardening_openvpn_for_def_con	Trust: 1.0
url:	https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/	Trust: 1.0
url:	https://issuetracker.google.com/issues/263721377	Trust: 1.0
url:	https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/	Trust: 1.0
url:	https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009	Trust: 1.0
url:	https://news.ycombinator.com/item?id=40279632	Trust: 1.0
url:	https://support.citrix.com/article/ctx677069/cloud-software-group-security-advisory-for-cve20243661	Trust: 1.0
url:	https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/	Trust: 1.0
url:	https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability	Trust: 1.0
url:	https://my.f5.com/manage/s/article/k000139553	Trust: 1.0
url:	https://datatracker.ietf.org/doc/html/rfc3442#section-7	Trust: 1.0

sources: NVD: CVE-2024-3661

SOURCES

db:

NVD

id:

CVE-2024-3661

LAST UPDATE DATE

2025-01-15T23:06:15.378000+00:00

SOURCES UPDATE DATE

db:

NVD

id:

CVE-2024-3661

date:

2025-01-15T16:50:28.667

SOURCES RELEASE DATE

db:

NVD

id:

CVE-2024-3661

date:

2024-05-06T19:15:11.027