CVE-2024-3661

Published: May 6, 2024Modified: Jun 17, 2026

7.6

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 2.8 / Impact: 4.7

Source: NVD

Description

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

Affected (26)

Products: Fortinet: Forticlient · Cisco: Anyconnect Vpn Client, Secure Client · Paloaltonetworks: Globalprotect · +4 more

Show all products

Fortinet: Forticlient · Cisco: Anyconnect Vpn Client, Secure Client · Paloaltonetworks: Globalprotect · Citrix: Secure Access Client · F5: Big Ip Access Policy Manager · Watchguard: Ipsec Mobile Vpn Client, Mobile Vpn With Ssl · Zscaler: Client Connector

Fortinet

1 product

Forticlient

Cisco

2 products

Anyconnect Vpn Client

1 product

1 product

1 product

Big Ip Access Policy Manager

Watchguard

2 products

Ipsec Mobile Vpn Client

Mobile Vpn With Ssl

Zscaler

1 product

Client Connector

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fortinet Forticlient	From 6.4.0 to 7.2.5
Fortinet Forticlient	From 6.4.0 to 7.2.5
Fortinet Forticlient	From 6.4.0 to 7.2.5
Fortinet Forticlient	Version 7.4.0
Fortinet Forticlient	Version 7.4.0
Fortinet Forticlient	Version 7.4.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Anyconnect Vpn Client	All versions
Cisco Secure Client	All versions

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Paloaltonetworks Globalprotect	All versions
Paloaltonetworks Globalprotect	All versions
Paloaltonetworks Globalprotect	All versions
Paloaltonetworks Globalprotect	All versions

Configuration D

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Citrix Secure Access Client	Before 24.06.1

Running on/with	Platform Versions
Apple Iphone Os	All versions
Apple Macos	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Citrix Secure Access Client	Before 24.8.5

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Access Policy Manager	From 15.1.0 to 15.1.10
F5 Big Ip Access Policy Manager	From 16.1.0 to 16.1.5
F5 Big Ip Access Policy Manager	From 17.1.0 to 17.1.2
F5 Big Ip Access Policy Manager	From 7.2.3 to 7.2.5

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Watchguard Ipsec Mobile Vpn Client	All versions
Watchguard Ipsec Mobile Vpn Client	All versions
Watchguard Mobile Vpn With Ssl	All versions
Watchguard Mobile Vpn With Ssl	All versions

Configuration H

4 vulnerable

Vulnerable Software	Affected Versions
Zscaler Client Connector	Before 1.5.1.25
Zscaler Client Connector	From 3.7 to 3.7.0.134
Zscaler Client Connector	Before 4.2.0.282
Zscaler Client Connector	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CWE-501

Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message.