FKIE_CVE-2024-3661

Vulnerability from fkie_nvd - Published: 2024-05-06 19:15 - Updated: 2025-01-15 16:50
Severity ?
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
7.6 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Summary
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
References
9119a7d8-5eab-497f-8521-727c672e3725https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/Press/Media Coverage
9119a7d8-5eab-497f-8521-727c672e3725https://bst.cisco.com/quickview/bug/CSCwk05814Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://datatracker.ietf.org/doc/html/rfc2131#section-7Related
9119a7d8-5eab-497f-8521-727c672e3725https://datatracker.ietf.org/doc/html/rfc3442#section-7Related
9119a7d8-5eab-497f-8521-727c672e3725https://fortiguard.fortinet.com/psirt/FG-IR-24-170Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://issuetracker.google.com/issues/263721377Issue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/Press/Media Coverage
9119a7d8-5eab-497f-8521-727c672e3725https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-trafficIssue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvisionThird Party Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://my.f5.com/manage/s/article/K000139553Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://news.ycombinator.com/item?id=40279632Issue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://news.ycombinator.com/item?id=40284111Issue Tracking
9119a7d8-5eab-497f-8521-727c672e3725https://security.paloaltonetworks.com/CVE-2024-3661Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://tunnelvisionbug.com/Exploit, Third Party Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://www.agwa.name/blog/post/hardening_openvpn_for_def_conRelated
9119a7d8-5eab-497f-8521-727c672e3725https://www.leviathansecurity.com/research/tunnelvisionThird Party Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/Press/Media Coverage
9119a7d8-5eab-497f-8521-727c672e3725https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009Mitigation, Third Party Advisory
9119a7d8-5eab-497f-8521-727c672e3725https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerabilityExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/Exploit, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://bst.cisco.com/quickview/bug/CSCwk05814Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://datatracker.ietf.org/doc/html/rfc2131#section-7Related
af854a3a-2127-422b-91ae-364da2661108https://datatracker.ietf.org/doc/html/rfc3442#section-7Related
af854a3a-2127-422b-91ae-364da2661108https://fortiguard.fortinet.com/psirt/FG-IR-24-170Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issuetracker.google.com/issues/263721377Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/Exploit, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-trafficIssue Tracking
af854a3a-2127-422b-91ae-364da2661108https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvisionThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://my.f5.com/manage/s/article/K000139553Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=40279632Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=40284111Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://security.paloaltonetworks.com/CVE-2024-3661Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tunnelvisionbug.com/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.agwa.name/blog/post/hardening_openvpn_for_def_conRelated
af854a3a-2127-422b-91ae-364da2661108https://www.leviathansecurity.com/research/tunnelvisionThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/Exploit, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerabilityExploit, Vendor Advisory
Impacted products
Vendor Product Version
fortinet forticlient *
fortinet forticlient *
fortinet forticlient *
fortinet forticlient 7.4.0
fortinet forticlient 7.4.0
fortinet forticlient 7.4.0
cisco anyconnect_vpn_client -
cisco secure_client -
paloaltonetworks globalprotect *
paloaltonetworks globalprotect *
paloaltonetworks globalprotect *
paloaltonetworks globalprotect *
citrix secure_access_client *
apple iphone_os -
apple macos -
citrix secure_access_client *
linux linux_kernel -
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
watchguard ipsec_mobile_vpn_client *
watchguard ipsec_mobile_vpn_client *
watchguard mobile_vpn_with_ssl *
watchguard mobile_vpn_with_ssl *
zscaler client_connector *
zscaler client_connector *
zscaler client_connector *
zscaler client_connector -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*",
              "matchCriteriaId": "F0918F54-0052-42BD-A73E-CFF198B9EC48",
              "versionEndExcluding": "7.2.5",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "81B7F626-84B5-47A5-959F-735D6250C147",
              "versionEndExcluding": "7.2.5",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "5E714EAF-73AB-41EA-AC57-E59B78FD7853",
              "versionEndExcluding": "7.2.5",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:linux:*:*",
              "matchCriteriaId": "7B728862-1FAB-47B4-823D-2C19CBF76DAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:*",
              "matchCriteriaId": "0A079CA4-D957-402A-B899-31F26A89DF00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:*",
              "matchCriteriaId": "6B512696-8596-4458-ADC9-24DD3C6C377B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:anyconnect_vpn_client:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "59289E79-5A0A-4675-B7D4-C759401736A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_client:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE81F5D2-269B-4098-AA9F-2DBCA3CB8813",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "8EEBB31D-BC9C-4EAD-86B1-8B95AB118A2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*",
              "matchCriteriaId": "4814D5DB-A96C-4D91-9DAE-87FF0DA101D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "72F88FEB-766B-4FCD-B78E-0E8E5E2B5CCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "D5537140-CDA3-4410-B101-24D1AB3624EA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB344FC1-AD7C-4988-A703-8B2CD0AEF57C",
              "versionEndExcluding": "24.06.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "697D4070-101A-45B1-99B1-F33ECF03945C",
              "versionEndExcluding": "24.8.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB16CE4D-183C-44B9-A5FF-6F9FA3C0A618",
              "versionEndIncluding": "7.2.5",
              "versionStartIncluding": "7.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A7F605E-EB10-40FB-98D6-7E3A95E310BC",
              "versionEndIncluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8FEC1DE-D11F-4DC8-8B21-51BAF1731A5F",
              "versionEndIncluding": "16.1.5",
              "versionStartIncluding": "16.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DE3A941-B898-4EAB-9073-C6A312E59FC5",
              "versionEndIncluding": "17.1.2",
              "versionStartIncluding": "17.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "FFB4A7FD-AC96-490D-9CBB-72166D46C4FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "2EAD2DBA-3038-4EF8-8BAE-80BD3DA97B33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "AB8A39F6-8AD5-4B9D-92E4-7E28EE78C5B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "0AF97158-6BB8-47CA-8214-98D2F801C8BA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*",
              "matchCriteriaId": "1F206869-8FCE-40AE-ADDC-62F221E00004",
              "versionEndExcluding": "1.5.1.25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:*",
              "matchCriteriaId": "7D37D825-E2B8-4924-AA8A-ACB0E08A3C61",
              "versionEndExcluding": "4.2.0.282",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:*",
              "matchCriteriaId": "4EC77FDF-1E1A-4638-9C9F-DA4205FDD69B",
              "versionEndExcluding": "3.7.0.134",
              "versionStartIncluding": "3.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zscaler:client_connector:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "C057E1BC-C7BA-4EAF-8200-560035118FA0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DHCP can add routes to a client\u2019s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN."
    },
    {
      "lang": "es",
      "value": "Por dise\u00f1o, el protocolo DHCP no autentica mensajes, incluida, por ejemplo, la opci\u00f3n de ruta est\u00e1tica sin clases (121). Un atacante con la capacidad de enviar mensajes DHCP puede manipular rutas para redirigir el tr\u00e1fico VPN, lo que le permite leer, interrumpir o posiblemente modificar el tr\u00e1fico de red que se esperaba que estuviera protegido por la VPN. Muchos, si no la mayor\u00eda, de los sistemas VPN basados en enrutamiento IP son susceptibles a este tipo de ataques."
    }
  ],
  "id": "CVE-2024-3661",
  "lastModified": "2025-01-15T16:50:28.667",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-05-06T19:15:11.027",
  "references": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Related"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Related"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://issuetracker.google.com/issues/263721377"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://my.f5.com/manage/s/article/K000139553"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://news.ycombinator.com/item?id=40279632"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://news.ycombinator.com/item?id=40284111"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2024-3661"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://tunnelvisionbug.com/"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Related"
      ],
      "url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.leviathansecurity.com/research/tunnelvision"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Press/Media Coverage"
      ],
      "url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
    },
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Press/Media Coverage"
      ],
      "url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://bst.cisco.com/quickview/bug/CSCwk05814"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Related"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Related"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-170"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://issuetracker.google.com/issues/263721377"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Press/Media Coverage"
      ],
      "url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://my.f5.com/manage/s/article/K000139553"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://news.ycombinator.com/item?id=40279632"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://news.ycombinator.com/item?id=40284111"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2024-3661"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://tunnelvisionbug.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Related"
      ],
      "url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.leviathansecurity.com/research/tunnelvision"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Press/Media Coverage"
      ],
      "url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability"
    }
  ],
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-501"
        }
      ],
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.