7.6
CVE-2024-3661
- EPSS 4.06%
- Veröffentlicht 06.05.2024 19:15:11
- Zuletzt bearbeitet 15.01.2025 16:50:28
- Quelle 9119a7d8-5eab-497f-8521-727c67
- CVE-Watchlists
- Unerledigt
LoginDHCP routing options can manipulate interface-based VPN traffic
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ FortiClient SwPlatformlinux Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient SwPlatformmacos Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient SwPlatformwindows Version >= 6.4.0 < 7.2.5
Fortinet ≫ FortiClient Version7.4.0 SwPlatformlinux
Fortinet ≫ FortiClient Version7.4.0 SwPlatformmacos
Fortinet ≫ FortiClient Version7.4.0 SwPlatformwindows
Cisco ≫ Anyconnect Vpn Client Version-
Cisco ≫ Secure Client Version-
Paloaltonetworks ≫ Globalprotect SwPlatformiphone_os
Paloaltonetworks ≫ Globalprotect SwPlatformlinux
Paloaltonetworks ≫ Globalprotect SwPlatformmacos
Paloaltonetworks ≫ Globalprotect SwPlatformwindows
Citrix ≫ Secure Access Client Version < 24.8.5
F5 ≫ Big-ip Access Policy Manager Version >= 7.2.3 <= 7.2.5
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 <= 15.1.10
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 <= 16.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 17.1.0 <= 17.1.2
Watchguard ≫ Ipsec Mobile Vpn Client SwPlatformmacos
Watchguard ≫ Ipsec Mobile Vpn Client SwPlatformwindows
Watchguard ≫ Mobile Vpn With Ssl SwPlatformmacos
Watchguard ≫ Mobile Vpn With Ssl SwPlatformwindows
Zscaler ≫ Client Connector SwPlatformlinux Version < 1.5.1.25
Zscaler ≫ Client Connector SwPlatformmacos Version < 4.2.0.282
Zscaler ≫ Client Connector SwPlatformlinux Version >= 3.7 < 3.7.0.134
Zscaler ≫ Client Connector Version- SwPlatformwindows
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.06% | 0.894 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.6 | 2.8 | 4.7 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
|
| 9119a7d8-5eab-497f-8521-727c672e3725 | 7.6 | 2.8 | 4.7 |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-501 Trust Boundary Violation
The product mixes trusted and untrusted data in the same data structure or structured message.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
https://bst.cisco.com/quickview/bug/CSCwk05814
https://datatracker.ietf.org/doc/html/rfc2131#section-7
https://datatracker.ietf.org/doc/html/rfc3442#section-7
https://fortiguard.fortinet.com/psirt/FG-IR-24-170
https://issuetracker.google.com/issues/263721377
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
https://my.f5.com/manage/s/article/K000139553
https://news.ycombinator.com/item?id=40279632
https://news.ycombinator.com/item?id=40284111
https://security.paloaltonetworks.com/CVE-2024-3661
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661
https://tunnelvisionbug.com/
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con
https://www.leviathansecurity.com/research/tunnelvision
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability