Skip to content
Fencer Vulns
high 7.6

CVE-2024-3661 json

DHCP routing options can manipulate interface-based VPN traffic

published 2024-05-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-32236

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.1%
EPSS 4.1% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Patch / fix

  • fortinet forticlient 7.2.5
  • citrix secure_access_client 24.06.1, 24.8.5
  • zscaler client_connector 1.5.1.25, 3.7.0.134, 4.2.0.282
  • NetworkManager RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-ovs RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-ppp RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-tui RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-adsl RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-team RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-wifi RHEL 9 1:1.48.10-5.el9_5
  • NetworkManager-wwan RHEL 9 1:1.48.10-5.el9_5

red hat advisories RHSA-2025:16411RHSA-2025:0377RHSA-2025:0288

  • NetworkManager AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-ovs AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-ppp AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-tui AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-adsl AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-team AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-wifi AlmaLinux 9 1:1.48.10-5.el9_5
  • NetworkManager-wwan AlmaLinux 9 1:1.48.10-5.el9_5

almalinux advisories ALSA-2025:0377ALSA-2025:0288

  • NetworkManager Rocky Linux 8 1:1.40.16-18.el8_10
  • NetworkManager Rocky Linux 9 1:1.48.10-5.el9_5

rocky linux advisories RLSA-2025:0288RLSA-2025:0377

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3661 updated cvss 7.6

DHCP: DHCP routing options can manipulate interface-based VPN traffic

  • Red Hat Enterprise Linux 6 NetworkManager, NetworkManager-glib, NetworkManager-gnome Red Hat Enterprise Linux 7 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-glib, +8 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 9) NetworkManager-debuginfo 1.48.10-5.el9_5, NetworkManager-debugsource 1.48.10-5.el9_5, NetworkManager-libnm-devel 1.48.10-5.el9_5, NetworkManager-ovs-debuginfo 1.48.10-5.el9_5, NetworkManager-ppp-debuginfo 1.48.10-5.el9_5, NetworkManager-tui-debuginfo 1.48.10-5.el9_5, +7 more
    fixed: vendor fix RHSA-2025:0377
  • Red Hat CodeReady Linux Builder EUS (v.9.4) NetworkManager-debuginfo 1.46.0-34.el9_4, NetworkManager-debugsource 1.46.0-34.el9_4, NetworkManager-libnm-devel 1.46.0-34.el9_4, NetworkManager-ovs-debuginfo 1.46.0-34.el9_4, NetworkManager-ppp-debuginfo 1.46.0-34.el9_4, NetworkManager-tui-debuginfo 1.46.0-34.el9_4, +7 more
    fixed: vendor fix RHSA-2025:16411
  • Red Hat Enterprise Linux AppStream (v. 8) NetworkManager-cloud-setup 1.40.16-18.el8_10
    fixed: vendor fix RHSA-2025:0288
  • Red Hat Enterprise Linux AppStream (v. 9) NetworkManager-ovs 1.48.10-5.el9_5, NetworkManager-ppp 1.48.10-5.el9_5, NetworkManager-cloud-setup 1.48.10-5.el9_5, NetworkManager-dispatcher-routing-rules 1.48.10-5.el9_5, NetworkManager-config-connectivity-redhat 1.48.10-5.el9_5
    fixed: vendor fix RHSA-2025:0377
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) NetworkManager-ovs 1.46.0-34.el9_4, NetworkManager-ppp 1.46.0-34.el9_4, NetworkManager-cloud-setup 1.46.0-34.el9_4, NetworkManager-dispatcher-routing-rules 1.46.0-34.el9_4, NetworkManager-config-connectivity-redhat 1.46.0-34.el9_4
    fixed: vendor fix RHSA-2025:16411
  • Red Hat Enterprise Linux BaseOS (v. 8) NetworkManager 1.40.16-18.el8_10, NetworkManager-ovs 1.40.16-18.el8_10, NetworkManager-ppp 1.40.16-18.el8_10, NetworkManager-tui 1.40.16-18.el8_10, NetworkManager-adsl 1.40.16-18.el8_10, NetworkManager-team 1.40.16-18.el8_10, +8 more
    fixed: vendor fix RHSA-2025:0288
  • Red Hat Enterprise Linux BaseOS (v. 9) NetworkManager 1.48.10-5.el9_5, NetworkManager-tui 1.48.10-5.el9_5, NetworkManager-adsl 1.48.10-5.el9_5, NetworkManager-team 1.48.10-5.el9_5, NetworkManager-wifi 1.48.10-5.el9_5, NetworkManager-wwan 1.48.10-5.el9_5, +4 more
    fixed: vendor fix RHSA-2025:0377
show 3 more
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) NetworkManager 1.46.0-34.el9_4, NetworkManager-tui 1.46.0-34.el9_4, NetworkManager-adsl 1.46.0-34.el9_4, NetworkManager-team 1.46.0-34.el9_4, NetworkManager-wifi 1.46.0-34.el9_4, NetworkManager-wwan 1.46.0-34.el9_4, +4 more
    fixed: vendor fix RHSA-2025:16411
  • Red Hat Enterprise Linux CRB (v. 8) NetworkManager-debuginfo 1.40.16-18.el8_10, NetworkManager-debugsource 1.40.16-18.el8_10, NetworkManager-libnm-devel 1.40.16-18.el8_10, NetworkManager-ovs-debuginfo 1.40.16-18.el8_10, NetworkManager-ppp-debuginfo 1.40.16-18.el8_10, NetworkManager-tui-debuginfo 1.40.16-18.el8_10, +7 more
    fixed: vendor fix RHSA-2025:0288
  • Red Hat Enterprise Linux 6 dhcp, dhclient, dhcp-common Red Hat Enterprise Linux 7 dhcp, dhclient, dhcp-libs, dhcp-common Red Hat Enterprise Linux 8 dhcp, dhcp-libs, dhcp-relay, dhcp-client, dhcp-common, dhcp-server Red Hat Enterprise Linux 9 dhcp, dhcp-relay, dhcp-client, dhcp-common, dhcp-server Red Hat Enterprise Linux 10 dhcpcd, NetworkManager
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

4.06% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • tunnelvisionbug.com https://tunnelvisionbug.com/ referenced PoC, tagged "exploit" by a source, unverified
  • arstechnica.com https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ referenced PoC, tagged "exploit" by a source, unverified
  • krebsonsecurity.com https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ referenced PoC, tagged "exploit" by a source, unverified
  • zscaler.com https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability referenced PoC, tagged "exploit" by a source, unverified
  • theregister.com https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD 3.1 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected products

  • IETF DHCP

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality
  • CWE-501 Trust Boundary Violation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.