CVE-2024-3661: cisco anyconnect_vpn_client
Vulnerability summary
CVE-2024-3661 is a high (CVSS 7.6) vulnerability in cisco anyconnect_vpn_client. EPSS estimates a 4.06% chance of exploitation in the next 30 days, higher than 90.5% of scored vulnerabilities. 5 public exploits are recorded.
Timeline
- 06-05-2024PublishedVulnerability first disclosed.
- 28-08-2024Last modifiedVulnerability information updated.
Description
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.6HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated7.6HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- NVDNIST7.6HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS trend
Probability
4.06%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.06% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploit Reference (tunnelvisionbug.com)
Maturity: unknown
Exploit Reference (arstechnica.com)
Maturity: unknown
Exploit Reference (krebsonsecurity.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-501Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message.
Affected systems
Ubuntu29 products
- connmanAll versions (No fix recorded)
- gadmin-openvpn-clientAll versions (No fix recorded)
- gadmin-openvpn-serverAll versions (No fix recorded)
- golang-github-apparentlymart-go-openvpn-mgmtAll versions (No fix recorded)
- kvpncAll versions (No fix recorded)
Redhat28 products
- NetworkManager< 1:1.40.16-18.el8_10 | < 1:1.48.10-5.el9_5 | < 1:1.46.0-34.el9_4
- NetworkManager-adsl< 1:1.40.16-18.el8_10 | < 1:1.48.10-5.el9_5 | < 1:1.46.0-34.el9_4
- NetworkManager-adsl-debuginfo< 1:1.40.16-18.el8_10 | < 1:1.48.10-5.el9_5 | < 1:1.46.0-34.el9_4
- NetworkManager-bluetooth< 1:1.40.16-18.el8_10 | < 1:1.48.10-5.el9_5 | < 1:1.46.0-34.el9_4
- NetworkManager-bluetooth-debuginfo< 1:1.40.16-18.el8_10 | < 1:1.48.10-5.el9_5 | < 1:1.46.0-34.el9_4
Cisco2 products
Citrix1 product
- secure_access_client< 24.06.1 | < 24.8.5
F51 product
- big-ip_access_policy_manager≥ 7.2.3, ≤ 7.2.5 | ≥ 15.1.0, ≤ 15.1.10 | ≥ 16.1.0, ≤ 16.1.5 | ≥ 17.1.0, ≤ 17.1.2
Fortinet1 product
- forticlient≥ 6.4.0, < 7.2.5 | 7.4.0
Ietf1 product
- dhcpAll versions (No fix recorded)
Zscaler1 product
- client_connector< 1.5.1.25 | < 4.2.0.282 | ≥ 3.7, < 3.7.0.134 | na
8 vendors · 64 products
References
33 links- krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ARTICLEREPORTExploitPress/Media Coverage
Show all 33 references
- www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009ARTICLEMitigationThird Party AdvisoryVendor Advisory
