Lucene search

K
nvd9119a7d8-5eab-497f-8521-727c672e3725NVD:CVE-2024-3661
HistoryMay 06, 2024 - 7:15 p.m.

CVE-2024-3661

2024-05-0619:15:11
CWE-306
CWE-501
9119a7d8-5eab-497f-8521-727c672e3725
web.nvd.nist.gov
dhcp
classless static route
vulnerability
vpn
traffic leakage

7.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

References

7.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

Related for NVD:CVE-2024-3661