CVE-2024-3661

CWE-306 — Missing AuthenticationCWE-501CWE-3487 documents7 sources
Severity
7.6HIGH
EPSS
2.9%
top 13.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Citrix Secure Access ClientFortinet ForticlientZscaler Client Connector+2 more
Timeline
PublishedMay 6

Description

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LExploitability: 2.8 | Impact: 4.7

Affected Packages5 packages

▶CVEListV5ietf/dhcp0
▶NVDfortinet/forticlient6.4.0 — 7.2.5+1
▶NVDzscaler/client_connector3.7 — 3.7.0.134+2
▶NVDf5/big-ip_access_policy_manager7.2.3 — 7.2.5+3

🔴Vulnerability Details

3
CVEList
DHCP routing options can manipulate interface-based VPN traffic↗2024-05-06
▶
GHSA
GHSA-jcv7-6v4q-4m7x: By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121)↗2024-05-06
▶
OSV
CVE-2024-3661: DHCP can add routes to a client’s routing table via the classless static route option (121)↗2024-05-06
▶

📋Vendor Advisories

1
Red Hat
DHCP: DHCP routing options can manipulate interface-based VPN traffic↗2024-05-06
▶
CVE-2024-3661 (HIGH CVSS 7.6) | DHCP can add routes to a client’s r | cvebase.io