CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – Evasión del túnel dividido de VPN mediante inyección de opciones DHCP Código del programa servidor DHCP simulado en Python + cliente root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def...

CLSA-2025-1764322970 NetworkManager: Fix of CVE-2024-3661

CVE-2024-3661: fix TunnelVision vulnerability by preventing DHCP option 121 route manipulation that could bypass VPN encryption and leak traffic...

GHSA-HQMP-G7PH-X543 TunnelVision - decloaking VPNs using DHCP

A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the...

Impact of TunnelVision Vulnerability

The Palo Alto Networks Product Security Assurance team has evaluated the TunnelVision vulnerability as it relates to our products. This issue allows an attacker with the ability to send DHCP messages on the same local area network, such as a rogue Wi-Fi network, to leak traffic outside of the...

New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation

Researchers have detailed a Virtual Private Network VPN bypass technique dubbed TunnelVision that allows threat actors to snoop on victim's network traffic by just being on the same local network. The "decloaking" method has been assigned the CVE identifier CVE-2024-3661 CVSS score: 7.6. It impac...

New Attack on VPNs

This attack has been feasible for over two decades: Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering. TunnelVision, ...