CVE-2024-3661 DHCP routing options can manipulate interface-based VPN traffic
Local attackers can manipulate DHCP routes to bypass VPN protections, exposing or modifying protected network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3661?
CVE-2024-3661 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 6 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Which versions are affected by CVE-2024-3661?
It affects 9 products.
Linux distribution packages (40)
NetworkManager AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-adsl AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-bluetooth AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-cloud-setup AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-config-connectivity-redhat AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-config-server AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-dispatcher-routing-rules AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-initscripts-updown AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-libnm AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-libnm-devel AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-ovs AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-ppp AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-team AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-tui AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-wifi AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-wwan AlmaLinux:8 | All versions | 1:1.40.16-18.el8_10 |
NetworkManager AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-adsl AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-bluetooth AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-cloud-setup AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-config-connectivity-redhat AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-config-server AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-dispatcher-routing-rules AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-initscripts-updown AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-libnm AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-libnm-devel AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-ovs AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-ppp AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-team AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-tui AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-wifi AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-wwan AlmaLinux:9 | All versions | 1:1.48.10-5.el9_5 |
NetworkManager-adsl-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-bluetooth-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-cloud-setup Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-cloud-setup-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-libnm-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
NetworkManager-ovs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:1.40.16-18.el8_10 |
Products include Cisco Anyconnect Vpn Client, Cisco Secure Client, Citrix Secure Access Client, F5 Big-Ip Access Policy Manager, Fortinet Forticlient, Paloaltonetworks Globalprotect and 3 more.
How do I fix CVE-2024-3661?
Apply the vendor's patch.
Is CVE-2024-3661 being exploited?
There is no known exploitation of CVE-2024-3661 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as ALSA-2025:0288, ALSA-2025:0377, CLSA-2025-1764322970, GHSA-jcv7-6v4q-4m7x, RHSA-2025:0288, RHSA-2025:0377 and 4 more.