CVE-2023-36672

What it actually does

The VPN client configures the operating system routing table such that traffic destined to the local network (including non-RFC1918 subnets) is sent in plaintext outside the encrypted VPN tunnel.

Why it matters to the business

Sensitive internal traffic can be observed or intercepted by other devices on the same network, increasing risk of data exposure for users relying on the client for confidentiality.

How an attack unfolds

An attacker on the same local network positions themselves to receive or observe traffic that the victim sends to local addresses; the victim initiates connections believing they are protected by the VPN, but the packets leak in plaintext due to the misconfigured routes.

How to fix it

Update the Clario VPN client to the latest available version that enforces proper tunnel routing for all local traffic; if no update exists, consider an alternative VPN solution that correctly handles LocalNet scenarios and verify route configuration after installation.

How to confirm the fix worked

After applying updates, inspect the system routing table while the VPN is active to confirm that local network destinations are covered by the tunnel interface rather than physical interfaces.

Typical attack path

1. Attacker joins the same local network as the victim.
2. Victim launches the VPN client and connects.
3. Victim initiates traffic to local network resources.
4. Packets are routed in plaintext outside the tunnel per the client's OS configuration.
5. Attacker captures or inspects the leaked plaintext traffic.

How to detect it

Review VPN client logs and system network configuration snapshots for evidence of routes that exclude local subnets from the tunnel; correlate with network monitoring for unexpected plaintext traffic from the host.

What your security team should do

• Prioritize migration away from the affected client for any users on shared networks.
• Monitor vendor release notes for a corrected version and test routing behavior in a lab environment.
• Educate users on risks of VPN clients that leak local traffic and recommend verifying split-tunnel or full-tunnel settings.