CVE-2024-3661
Assigner: cisa-cg
Published: 2024-05-06T18:31:21.217Z
State: PUBLISHED
affected: defaultStatus: affected
product: DHCP
vendor: IETF
versions: status: affected
version: 0
datePublic: 2002-12-31T01:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
value: DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-306
description: CWE-306 Missing Authentication for Critical Function
type: CWE
descriptions: cweId: CWE-501
description: CWE-501 Trust Boundary Violation
type: CWE
source: discovery: UNKNOWN
title: DHCP routing options can manipulate interface-based VPN traffic
x_generator: engine: Vulnogram 0.1.0-dev