Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-3661 Details

Description

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.6 HIGHVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CNA: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian GovernmentCVSS-B:7.6 HIGHVector:CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	ExploitPress/Media Coverage
https://bst.cisco.com/quickview/bug/CSCwk05814	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Third Party AdvisoryVendor Advisory
https://datatracker.ietf.org/doc/html/rfc2131#section-7	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Related
https://datatracker.ietf.org/doc/html/rfc3442#section-7	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Related
https://fortiguard.fortinet.com/psirt/FG-IR-24-170	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Vendor Advisory
https://issuetracker.google.com/issues/263721377	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Issue Tracking
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	ExploitPress/Media Coverage
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Issue Tracking
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Third Party Advisory
https://my.f5.com/manage/s/article/K000139553	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Vendor Advisory
https://news.ycombinator.com/item?id=40279632	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Issue Tracking
https://news.ycombinator.com/item?id=40284111	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Issue Tracking
https://security.paloaltonetworks.com/CVE-2024-3661	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Vendor Advisory
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Vendor Advisory
https://tunnelvisionbug.com/	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	ExploitThird Party Advisory
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Related
https://www.leviathansecurity.com/research/tunnelvision	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	Third Party Advisory
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	ExploitPress/Media Coverage
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	MitigationThird Party AdvisoryVendor Advisory
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government	ExploitThird Party AdvisoryVendor Advisory
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/	CVE	ExploitPress/Media Coverage
https://bst.cisco.com/quickview/bug/CSCwk05814	CVE	Third Party AdvisoryVendor Advisory
https://datatracker.ietf.org/doc/html/rfc2131#section-7	CVE	Related
https://datatracker.ietf.org/doc/html/rfc3442#section-7	CVE	Related
https://fortiguard.fortinet.com/psirt/FG-IR-24-170	CVE	Vendor Advisory
https://issuetracker.google.com/issues/263721377	CVE	Issue Tracking
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/	CVE	ExploitPress/Media Coverage
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic	CVE	Issue Tracking
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision	CVE	Third Party Advisory
https://my.f5.com/manage/s/article/K000139553	CVE	Vendor Advisory
https://news.ycombinator.com/item?id=40279632	CVE	Issue Tracking
https://news.ycombinator.com/item?id=40284111	CVE	Issue Tracking
https://security.paloaltonetworks.com/CVE-2024-3661	CVE	Vendor Advisory
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661	CVE	Vendor Advisory
https://tunnelvisionbug.com/	CVE	ExploitThird Party Advisory
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con	CVE	Related
https://www.leviathansecurity.com/research/tunnelvision	CVE	Third Party Advisory
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/	CVE	ExploitPress/Media Coverage
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009	CVE	MitigationThird Party AdvisoryVendor Advisory
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability	CVE	ExploitThird Party AdvisoryVendor Advisory

see all 40 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-306	Missing Authentication for Critical Function	[email protected]
CWE-306	Missing Authentication for Critical Function	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
CWE-501	Trust Boundary Violation	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Affected Products

Product	Versions
fortinet forticlient	>= 6.4.0, < 7.2.5 7.4.0
CPE cpe:2.3:a:fortinet:forticlient::::::linux::* cpe:2.3:a:fortinet:forticlient::::::macos::* cpe:2.3:a:fortinet:forticlient::::::windows::* cpe:2.3:a:fortinet:forticlient:7.4.0:::::linux:: cpe:2.3:a:fortinet:forticlient:7.4.0:::::macos:: cpe:2.3:a:fortinet:forticlient:7.4.0:::::windows:: Remediation No remediation found in references.
cisco anyconnect vpn client	All versions
CPE cpe:2.3:a:cisco:anyconnect_vpn_client:-:::::::* Remediation No remediation found in references.
cisco secure client	All versions
CPE cpe:2.3:a:cisco:secure_client:-:::::::* Remediation No remediation found in references.
paloaltonetworks globalprotect	All versions
CPE cpe:2.3:a:paloaltonetworks:globalprotect::::::iphone_os::* cpe:2.3:a:paloaltonetworks:globalprotect::::::linux::* cpe:2.3:a:paloaltonetworks:globalprotect::::::macos::* cpe:2.3:a:paloaltonetworks:globalprotect::::::windows::* Remediation No remediation found in references.
citrix secure access client	< 24.06.1 < 24.8.5
CPE cpe:2.3:a:citrix:secure_access_client:::::::: Remediation No remediation found in references.
apple iphone os	All versions
CPE cpe:2.3:o:apple:iphone_os:-:::::::* Remediation No remediation found in references.
apple macos	All versions
CPE cpe:2.3:o:apple:macos:-:::::::* Remediation No remediation found in references.
linux linux kernel	All versions
CPE cpe:2.3:o:linux:linux_kernel:-:::::::* Remediation No remediation found in references.
f5 big-ip access policy manager	>= 7.2.3, <= 7.2.5 >= 15.1.0, <= 15.1.10 >= 16.1.0, <= 16.1.5 >= 17.1.0, <= 17.1.2
CPE cpe:2.3:a:f5:big-ip_access_policy_manager:::::::: Remediation No remediation found in references.
watchguard ipsec mobile vpn client	All versions
CPE cpe:2.3:a:watchguard:ipsec_mobile_vpn_client::::::macos::* cpe:2.3:a:watchguard:ipsec_mobile_vpn_client::::::windows::* Remediation No remediation found in references.
watchguard mobile vpn with ssl	All versions
CPE cpe:2.3:a:watchguard:mobile_vpn_with_ssl::::::macos::* cpe:2.3:a:watchguard:mobile_vpn_with_ssl::::::windows::* Remediation No remediation found in references.
zscaler client connector	< 1.5.1.25 < 4.2.0.282 >= 3.7, < 3.7.0.134
CPE cpe:2.3:a:zscaler:client_connector::::::linux::* cpe:2.3:a:zscaler:client_connector::::::macos::* cpe:2.3:a:zscaler:client_connector:-:::::windows:: Remediation No remediation found in references.

Change History

13 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Jun 17, 2026	CVE Modified	CISA-ADP
Jan 15, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
Jul 1, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 14, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 8, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 8, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 7, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 7, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 7, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 7, 2024	CVE Modified	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
May 6, 2024	New CVE Received	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

CVE-2024-3661 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO