7.6
CVE-2024-3661
- EPSS 4.06%
- Veröffentlicht 06.05.2024 19:15:11
- Zuletzt bearbeitet 15.01.2025 16:50:28
- Erkennungen
LoginDHCP routing options can manipulate interface-based VPN traffic
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ FortiClient SwPlatform linux Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient SwPlatform macos Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient SwPlatform windows Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient Version 7.4.0 SwPlatform linux
Fortinet ≫ FortiClient Version 7.4.0 SwPlatform macos
Fortinet ≫ FortiClient Version 7.4.0 SwPlatform windows
Cisco ≫ Anyconnect Vpn Client Version -
Cisco ≫ Secure Client Version -
Paloaltonetworks ≫ Globalprotect SwPlatform iphone_os
Paloaltonetworks ≫ Globalprotect SwPlatform linux
Paloaltonetworks ≫ Globalprotect SwPlatform macos
Paloaltonetworks ≫ Globalprotect SwPlatform windows
Citrix ≫ Secure Access Client Version < 24.8.5
F5 ≫ Big-ip Access Policy Manager Version >= 7.2.3 <= 7.2.5
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 <= 15.1.10
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 <= 16.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 17.1.0 <= 17.1.2
Watchguard ≫ Ipsec Mobile Vpn Client SwPlatform macos
Watchguard ≫ Ipsec Mobile Vpn Client SwPlatform windows
Watchguard ≫ Mobile Vpn With Ssl SwPlatform macos
Watchguard ≫ Mobile Vpn With Ssl SwPlatform windows
Zscaler ≫ Client Connector SwPlatform linux Version < 1.5.1.25
Zscaler ≫ Client Connector SwPlatform macos Version < 4.2.0.282
Zscaler ≫ Client Connector SwPlatform linux Version >= 3.7 < 3.7.0.134
Zscaler ≫ Client Connector Version - SwPlatform windows
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.06% | 0.894 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.6 | 2.8 | 4.7 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
|
| cisa-cg | 7.6 | 2.8 | 4.7 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-501 Trust Boundary Violation
The product mixes trusted and untrusted data in the same data structure or structured message.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
https://bst.cisco.com/quickview/bug/CSCwk05814
https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://fortiguard.fortinet.com/psirt/FG-IR-24-170
https://issuetracker.google.com/issues/263721377
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://my.f5.com/manage/s/article/K000139553
https://news.ycombinator.com/item?id=40279632
https://news.ycombinator.com/item?id=40284111
https://security.paloaltonetworks.com/CVE-2024-3661
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661
https://tunnelvisionbug.com/
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.leviathansecurity.com/research/tunnelvision
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability