7.6 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.3 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.2%
The Palo Alto Networks Product Security Assurance team has evaluated the TunnelVision vulnerability as it relates to our products. This issue allows an attacker with the ability to send DHCP messages on the same local area network, such as a rogue Wi-Fi network, to leak traffic outside of the GlobalProtect tunnel, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the GlobalProtect tunnel. However, this attack does not enable the attacker to decrypt HTTPS or other encrypted traffic.
Cloud NGFW, PAN-OS, and Prisma Access do not process DHCP option 121 and are therefore unaffected.
GlobalProtect app on Windows and macOS systems with Endpoint Traffic Policy Enforcement enabled are unaffected. Endpoint Traffic Policy Enforcement is disabled by default.
GlobalProtect app on Linux is affected. A fix will be released in an upcoming release.
GlobalProtect app on iOS with IncludeAllNetworks set to 1 is unaffected.
GlobalProtect app on Android is unaffected since the Android DHCP client does not process DHCP option 121.
Work around:
For the GlobalProtect app on Windows, macOS, and Linux, this attack can be mitigated by enabling the “No direct access to local network” feature in the Split Tunnel tab on the firewall. Detailed information can be found at:
7.6 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
6.3 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.2%