---
cve: "CVE-2024-3661"
severity: "HIGH"
cvss: 7.6
epss: "4.1%"
vendor: "IETF"
kev: false
exploited: false
published: "2024-05-06 19:15:11"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T13:32:48+01:00"
---

# CVE-2024-3661

> 7.6 HIGH

## Beschreibung

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

## CNA-Record (Kanon, cvelistV5)

- CNA: **cisa-cg**
- State: PUBLISHED
- Stand: 2024-08-28 19:09:06
- CNA-CVSS: **7.6** (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Benachbart | warn |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Gering | warn |

## Schwachstellen-Klasse

- **CWE-306** — Missing Authentication for Critical Functionality
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- **CWE-501** — Trust Boundary Violation
  The product mixes trusted and untrusted data in the same data structure or structured message.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-166 — Force the System to Reset Values](https://capec.mitre.org/data/definitions/166.html) _(Severity: Medium)_
- [CAPEC-216 — Communication Channel Manipulation](https://capec.mitre.org/data/definitions/216.html)

## BSI-Hinweise (deutsch)

- [VPN Clients / DHCP: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-1047) — _BSI-Einstufung: hoch_
  Ein Angreifer aus einem angrenzenden Netzwerk kann eine Schwachstelle in VPN-Clients ausnutzen, die auf DHCP konfigurierten Systemen laufen, um den Datenverkehr umzuleiten.

## Referenzen

- <https://datatracker.ietf.org/doc/html/rfc2131#section-7>
- <https://datatracker.ietf.org/doc/html/rfc3442#section-7>
- <https://tunnelvisionbug.com/>
- <https://www.leviathansecurity.com/research/tunnelvision>
- <https://news.ycombinator.com/item?id=40279632>
- <https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/>
- <https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/>
- <https://issuetracker.google.com/issues/263721377>
- <https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision>
- <https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability>
- <https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic>
- <https://news.ycombinator.com/item?id=40284111>
- <https://www.agwa.name/blog/post/hardening_openvpn_for_def_con>
- <https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/>
- <https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-3661/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_