What’s Vulnerable › Vulnerabilities
CVE-2024-3661: DHCP routing options can manipulate interface-based VPN traffic
- Severity: high (CVSS 7.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-05-06 · updated 2026-06-17
- Weakness: CWE-306
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Affected products
- Cisco Anyconnect Vpn Client: all versions
- Cisco Secure Client: all versions
- Citrix Secure Access Client for Windows: before 24.06.1; before 24.8.5 — fixed in 24.06.1, 24.8.5
- F5 BIG-IP APM: from 7.2.3 through 7.2.5; from 15.1.0 through 15.1.10; from 16.1.0 through 16.1.5; from 17.1.0 through 17.1.2
- Fortinet FortiClientWindows: from 6.4.0 before 7.2.5; 7.4.0 (and their updates) — fixed in 7.2.5
- Palo Alto Networks GlobalProtect App: all versions
- WatchGuard Ipsec Mobile Vpn Client: all versions
- WatchGuard Mobile VPN with SSL Client: all versions
- Zscaler Client Connector: before 1.5.1.25; before 4.2.0.282; from 3.7 before 3.7.0.134 — fixed in 1.5.1.25, 4.2.0.282, 3.7.0.134
- IETF DHCP: 0
How to fix
Upgrade to a fixed version: Citrix Secure Access Client for Windows 24.06.1, 24.8.5; Fortinet FortiClientWindows 7.2.5; Zscaler Client Connector 1.5.1.25, 4.2.0.282, 3.7.0.134. Check the vendor advisory for mitigations.
References
- https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/
- https://bst.cisco.com/quickview/bug/CSCwk05814
- https://datatracker.ietf.org/doc/html/rfc2131#section-7
- https://datatracker.ietf.org/doc/html/rfc3442#section-7
- https://fortiguard.fortinet.com/psirt/FG-IR-24-170
- https://issuetracker.google.com/issues/263721377
- https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
- https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic
- https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
- https://my.f5.com/manage/s/article/K000139553
- https://news.ycombinator.com/item?id=40279632
- https://news.ycombinator.com/item?id=40284111
Get alerted when CVE-2024-3661 or the next vulnerability affects your stack