7.6 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.3%
Cloud Software Group has evaluated the impact of vulnerability CVE-2024-3661 on our products. This vulnerability may allow an attacker on the same local network as the victim to read, disrupt, or modify network traffic expected to be protected by the VPN.
Please find below the impact status:
* Status: Not impacted
* Status: Not impacted
* Status: Impacted - A fix addressing this issue will be released in an upcoming release.
* Customers using MDM (Mobile Device Management):
* Status: Impacted
* Recommendation:
* Install the latest update listed below as soon as possible to reduce the risk of exploitation: 24.06.1
* **AND**
* set โEnforceRoutesโ to โ1โ in the managed VPN configuration
* Mitigating factors/Workaround:
* Configure the settings listed below to reduce the risk of exploitation:
* set โEnforceRoutesโ to โ1โ in the managed VPN configuration and Local LAN access to โOFFโ on the Gateway
* Customers not using MDM (Mobile Device Management):
* Status: Impacted
* Recommendation:
* Install the latest update listed below as soon as possible to reduce the risk of exploitation: 24.06.1
* Mitigating factors/Workaround:
* Configure the settings listed below to reduce the risk of exploitation:
set Local LAN access to โOFFโ on the Gateway
Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at <https://support.citrix.com/securitybulletins>.
If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at <https://www.citrix.com/support/open-a-support-case>.
Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at <https://support.citrix.com/user/alerts>.
Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: <https://www.citrix.com/about/trust-center/vulnerability-process.html>.
This document is provided on an โas isโ basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. Citrix reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document directly from the Citrix Knowledge Center.
2024-06-24 | Initial Publication |
---|---|
2024-06-24 | Enabled email notification to subscribers |
7.6 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.3%