CVE-2024-3661

What it actually does

The flaw permits an attacker on the local network to inject classless static routes (DHCP option 121) into the client's routing table, overriding VPN-enforced routes and causing traffic intended for the VPN tunnel to egress via the physical interface instead.

Why it matters to the business

Traffic expected to remain confidential within a VPN can be read, disrupted, or altered by a local attacker, increasing risk of data exposure or session manipulation for any organization relying on route-based VPN protections.

How an attack unfolds

An attacker shares the same broadcast domain as the target, responds to or spoofs DHCP messages, and supplies crafted classless static route options that redirect VPN-bound destinations to the physical interface, resulting in leakage of protected traffic.

How to fix it

Apply vendor patches that validate or ignore untrusted DHCP route options; configure clients to prefer VPN routes or use cryptographic DHCP authentication where available; enforce least-privilege network segmentation to limit local attackers.

How to confirm the fix worked

After applying updates, verify that DHCP-supplied routes do not override VPN routes by inspecting the routing table during a DHCP lease renewal while the VPN is active; confirm expected traffic paths with packet captures.

Typical attack path

1. Gain presence on the same local network segment as the victim
2. Observe or trigger DHCP requests from the target client
3. Craft and send DHCP responses containing malicious classless static route (option 121) entries
4. Force traffic that should traverse the VPN to exit via the physical interface
5. Observe, intercept, or modify the leaked traffic

How to detect it

Inspect DHCP logs and client routing tables for unsolicited or anomalous classless static route options; correlate with VPN session events showing unexpected interface usage; review packet captures for DHCP messages containing option 121 with non-VPN next-hop addresses.

What your security team should do

• Prioritize patching DHCP clients and VPN software on all endpoints that rely on route-based split tunneling
• Monitor routing table changes on managed devices for unexpected DHCP-originated routes
• Consider disabling classless static route processing or enforcing strict VPN route precedence until patches are deployed
• Review network segmentation to reduce the number of devices sharing broadcast domains with untrusted hosts