CVE-2023-36673

What it actually does

The VPN client misconfigures system routing and DNS resolution so that all IP traffic to the VPN server address bypasses the encrypted tunnel and DNS lookups for the server occur in plaintext, enabling an on-path attacker to redirect or observe arbitrary traffic via spoofed responses.

Why it matters to the business

Sensitive corporate or personal data intended to be protected by the VPN can be exposed on untrusted networks, increasing risk of interception, credential theft, or regulatory non-compliance until the client is replaced.

How an attack unfolds

An attacker on the same network performs DNS spoofing against the plaintext lookup for the VPN server hostname, causing the victim to send subsequent traffic destined for arbitrary IPs outside the tunnel where the attacker can intercept or manipulate it as part of a ServerIP attack.

How to fix it

Replace Avira Phantom VPN with a client that correctly enforces full tunnel routing and encrypted DNS resolution; audit all macOS VPN configurations to ensure server traffic cannot leak outside the tunnel.

How to confirm the fix worked

Inspect system routing tables and DNS resolver settings while the VPN is active to confirm no plaintext routes or queries exist for the VPN server address; test connectivity to known internal resources exclusively through the tunnel.

Typical attack path

1. Attacker gains network adjacency to the victim
2. Spoof DNS responses for the VPN server hostname
3. Victim resolves server address in plaintext and initiates connection
4. System routes traffic to arbitrary destinations outside the tunnel
5. Attacker intercepts or injects data on the leaked plaintext flows

How to detect it

Review DNS query logs for plaintext resolutions of VPN server hostnames, examine routing tables for non-tunneled entries pointing to the server IP, and correlate with any unexpected outbound connections bypassing the VPN interface.

What your security team should do

• Immediately inventory and disable Avira Phantom VPN on all macOS endpoints
• Deploy an alternative enterprise VPN solution with verified tunnel integrity
• Add network monitoring for plaintext DNS queries to known VPN server domains
• Update endpoint detection rules to flag traffic bypassing the VPN interface