CVE-2024-3661

Katalog CVE

CVSS 7.6 · High EPSS 4,1%

Kerentanan Missing Authentication for Critical Function pada fortinet forticlient, cisco anyconnect vpn client +7 lainnya. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Rincian

Terbit di NVD

6 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-501: Trust Boundary Violation

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bst.cisco.com/quickview/bug/CSCwk05814 advisory pihak ketiga · advisory vendor
• https://fortiguard.fortinet.com/psirt/FG-IR-24-170 advisory vendor
• https://my.f5.com/manage/s/article/K000139553 advisory vendor
• https://security.paloaltonetworks.com/CVE-2024-3661 advisory vendor
• https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 advisory vendor
• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 mitigasi · advisory pihak ketiga · advisory vendor
• https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability exploit · advisory pihak ketiga · advisory vendor
• https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision advisory pihak ketiga
• https://tunnelvisionbug.com/ exploit · advisory pihak ketiga
• https://www.leviathansecurity.com/research/tunnelvision advisory pihak ketiga
• https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purp... exploit · press/media coverage
• https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ exploit · press/media coverage
• https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ exploit · press/media coverage
• https://datatracker.ietf.org/doc/html/rfc2131#section-7 related
• https://datatracker.ietf.org/doc/html/rfc3442#section-7 related
• https://issuetracker.google.com/issues/263721377 issue tracking
• https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-... issue tracking
• https://news.ycombinator.com/item?id=40279632 issue tracking
• https://news.ycombinator.com/item?id=40284111 issue tracking
• https://www.agwa.name/blog/post/hardening_openvpn_for_def_con related