| Added |
CVSS V3.1 |
|
NIST AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
|
| Added |
CWE |
|
NIST CWE-306
|
| Added |
CPE Configuration |
|
AND
OR
*cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:* versions up to (excluding) 24.06.1
OR
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
|
| Added |
CPE Configuration |
|
AND
OR
*cpe:2.3:a:citrix:secure_access_client:*:*:*:*:*:*:*:* versions up to (excluding) 24.8.5
OR
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:cisco:anyconnect_vpn_client:-:*:*:*:*:*:*:*
*cpe:2.3:a:cisco:secure_client:-:*:*:*:*:*:*:*
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 7.2.3 up to (including) 7.2.5
*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 15.1.0 up to (including) 15.1.10
*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 16.1.0 up to (including) 16.1.5
*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* versions from (including) 17.1.0 up to (including) 17.1.2
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5
*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5
*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:* versions from (including) 6.4.0 up to (excluding) 7.2.5
*cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:linux:*:*
*cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:*
*cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:*
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:iphone_os:*:*
*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:linux:*:*
*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:macos:*:*
*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:windows:*:*
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:macos:*:*
*cpe:2.3:a:watchguard:ipsec_mobile_vpn_client:*:*:*:*:*:windows:*:*
*cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:macos:*:*
*cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:windows:*:*
|
| Added |
CPE Configuration |
|
OR
*cpe:2.3:a:zscaler:client_connector:-:*:*:*:*:windows:*:*
*cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:* versions up to (excluding) 1.5.1.25
*cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:linux:*:* versions from (including) 3.7 up to (excluding) 3.7.0.134
*cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:macos:*:* versions up to (excluding) 4.2.0.282
|
| Changed |
Reference Type |
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ No Types Assigned
|
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ No Types Assigned
|
https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://bst.cisco.com/quickview/bug/CSCwk05814 No Types Assigned
|
https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory
|
| Changed |
Reference Type |
https://bst.cisco.com/quickview/bug/CSCwk05814 No Types Assigned
|
https://bst.cisco.com/quickview/bug/CSCwk05814 Third Party Advisory
|
| Changed |
Reference Type |
https://datatracker.ietf.org/doc/html/rfc2131#section-7 No Types Assigned
|
https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related
|
| Changed |
Reference Type |
https://datatracker.ietf.org/doc/html/rfc2131#section-7 No Types Assigned
|
https://datatracker.ietf.org/doc/html/rfc2131#section-7 Related
|
| Changed |
Reference Type |
https://datatracker.ietf.org/doc/html/rfc3442#section-7 No Types Assigned
|
https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related
|
| Changed |
Reference Type |
https://datatracker.ietf.org/doc/html/rfc3442#section-7 No Types Assigned
|
https://datatracker.ietf.org/doc/html/rfc3442#section-7 Related
|
| Changed |
Reference Type |
https://fortiguard.fortinet.com/psirt/FG-IR-24-170 No Types Assigned
|
https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory
|
| Changed |
Reference Type |
https://fortiguard.fortinet.com/psirt/FG-IR-24-170 No Types Assigned
|
https://fortiguard.fortinet.com/psirt/FG-IR-24-170 Vendor Advisory
|
| Changed |
Reference Type |
https://issuetracker.google.com/issues/263721377 No Types Assigned
|
https://issuetracker.google.com/issues/263721377 Issue Tracking
|
| Changed |
Reference Type |
https://issuetracker.google.com/issues/263721377 No Types Assigned
|
https://issuetracker.google.com/issues/263721377 Issue Tracking
|
| Changed |
Reference Type |
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ No Types Assigned
|
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ No Types Assigned
|
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic No Types Assigned
|
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking
|
| Changed |
Reference Type |
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic No Types Assigned
|
https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic Issue Tracking
|
| Changed |
Reference Type |
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision No Types Assigned
|
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory
|
| Changed |
Reference Type |
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision No Types Assigned
|
https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision Third Party Advisory
|
| Changed |
Reference Type |
https://my.f5.com/manage/s/article/K000139553 No Types Assigned
|
https://my.f5.com/manage/s/article/K000139553 Vendor Advisory
|
| Changed |
Reference Type |
https://my.f5.com/manage/s/article/K000139553 No Types Assigned
|
https://my.f5.com/manage/s/article/K000139553 Vendor Advisory
|
| Changed |
Reference Type |
https://news.ycombinator.com/item?id=40279632 No Types Assigned
|
https://news.ycombinator.com/item?id=40279632 Issue Tracking
|
| Changed |
Reference Type |
https://news.ycombinator.com/item?id=40279632 No Types Assigned
|
https://news.ycombinator.com/item?id=40279632 Issue Tracking
|
| Changed |
Reference Type |
https://news.ycombinator.com/item?id=40284111 No Types Assigned
|
https://news.ycombinator.com/item?id=40284111 Issue Tracking
|
| Changed |
Reference Type |
https://news.ycombinator.com/item?id=40284111 No Types Assigned
|
https://news.ycombinator.com/item?id=40284111 Issue Tracking
|
| Changed |
Reference Type |
https://security.paloaltonetworks.com/CVE-2024-3661 No Types Assigned
|
https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory
|
| Changed |
Reference Type |
https://security.paloaltonetworks.com/CVE-2024-3661 No Types Assigned
|
https://security.paloaltonetworks.com/CVE-2024-3661 Vendor Advisory
|
| Changed |
Reference Type |
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 No Types Assigned
|
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory
|
| Changed |
Reference Type |
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 No Types Assigned
|
https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 Vendor Advisory
|
| Changed |
Reference Type |
https://tunnelvisionbug.com/ No Types Assigned
|
https://tunnelvisionbug.com/ Exploit, Third Party Advisory
|
| Changed |
Reference Type |
https://tunnelvisionbug.com/ No Types Assigned
|
https://tunnelvisionbug.com/ Exploit, Third Party Advisory
|
| Changed |
Reference Type |
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con No Types Assigned
|
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related
|
| Changed |
Reference Type |
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con No Types Assigned
|
https://www.agwa.name/blog/post/hardening_openvpn_for_def_con Related
|
| Changed |
Reference Type |
https://www.leviathansecurity.com/research/tunnelvision No Types Assigned
|
https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory
|
| Changed |
Reference Type |
https://www.leviathansecurity.com/research/tunnelvision No Types Assigned
|
https://www.leviathansecurity.com/research/tunnelvision Third Party Advisory
|
| Changed |
Reference Type |
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ No Types Assigned
|
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ No Types Assigned
|
https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ Exploit, Press/Media Coverage
|
| Changed |
Reference Type |
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 No Types Assigned
|
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Vendor Advisory
|
| Changed |
Reference Type |
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 No Types Assigned
|
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 Mitigation, Vendor Advisory
|
| Changed |
Reference Type |
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability No Types Assigned
|
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Vendor Advisory
|
| Changed |
Reference Type |
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability No Types Assigned
|
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability Exploit, Vendor Advisory
|
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
