CVE-2023-36671

What it actually does

The VPN client misconfigures the host routing table so that all IP packets destined for the VPN server's real address are forwarded in plaintext on the physical interface instead of being encapsulated inside the tunnel.

Why it matters to the business

Users of affected macOS VPN software can have their true IP address and activity exposed to network observers, undermining privacy protections and potentially violating regulatory or contractual obligations for traffic confidentiality.

How an attack unfolds

An attacker first learns the public IP address of the VPN server the victim is using, then crafts a lure (e.g., a malicious link or file) that causes the victim to generate traffic to that exact IP; because the client has exempted the server address from the tunnel, the packets leave the host unencrypted and the attacker can observe or correlate them.

How to fix it

Upgrade the Clario VPN client to the newest release that corrects the routing configuration, or replace it with a client that properly routes all traffic including packets to the VPN server itself through the tunnel.

How to confirm the fix worked

After applying an update, verify that a packet capture on the physical interface shows no unencrypted IP traffic destined to the VPN server address while the tunnel is established; also confirm the host routing table contains no explicit host routes that bypass the tunnel interface for the server IP.

Typical attack path

1. Discover the real IP address of the VPN server the target uses
2. Prepare content that will cause the victim to send packets to that IP
3. Deliver the content so the victim triggers the connection while the VPN tunnel is active
4. Observe the resulting plaintext packets on the wire to link the victim with the destination

How to detect it

Review packet captures and firewall logs for any outbound traffic to known VPN server addresses that is not encapsulated inside the expected tunnel interface; correlate with VPN client process execution timestamps to identify periods when the tunnel should have been active.

What your security team should do

• Inventory all macOS endpoints running Clario VPN and prioritize upgrade or replacement
• Add the affected versions to vulnerability scanning policies with a 30-day remediation SLA
• Temporarily block or monitor outbound traffic to known Clario server IPs on non-tunneled interfaces as a compensating control