DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:0377 advisory.

    NetworkManager is a system network service that manages network devices and connections, attempting to     keep active network connectivity when available. Its capabilities include managing Ethernet, wireless,     mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of     different VPN services.

    Security and bug fix(es):

      * Routes in table different to main are not deleted on reapply [almalinux-9.5.z] (JIRA:AlmaLinux-73013)
      * Route to VPN server not stored in routing table that is specified by ipv4.route-table     [almalinux-9.5.z] (JIRA:AlmaLinux-73166)
      * VPN connections do not support ipv4.routing-rules settings [almalinux-9.5.z] (JIRA:AlmaLinux-73167)
      * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic     [almalinux-9.5.z] (JIRA:AlmaLinux-64726)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-0377 advisory.

    [1.48.10-5.0.1]
    - disable MPTCP handling by default [Orabug: 34801142]
    - add connectivity check via Oracle servers [Orabug: 32051972]

    [1:1.48.10-5]
    - vpn: Support routing rules in vpn conenctions (RHEL-73167)
    - vpn: Place gateway route to table defined in ipvx.route-table (RHEL-73166)

    [1:1.48.10-4]
    - Remove routes added by NetworkManager when doing reapply, also those not in main table (RHEL-73013)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0377 advisory.

    NetworkManager is a system network service that manages network devices and connections, attempting to     keep active network connectivity when available. Its capabilities include managing Ethernet, wireless,     mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of     different VPN services.

    Security and bug fix(es):

    * Routes in table different to main are not deleted on reapply [rhel-9.5.z] (JIRA:RHEL-73013)
    * Route to VPN server not stored in routing table that is specified by ipv4.route-table [rhel-9.5.z]     (JIRA:RHEL-73166)
    * VPN connections do not support ipv4.routing-rules settings [rhel-9.5.z] (JIRA:RHEL-73167)
    * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic     [rhel-9.5.z] (JIRA:RHEL-64726)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0288 advisory.

    Security and Bug Fix(es):

    * NetworkManager: DHCP routing options can manipulate interface-based VPN traffic (CVE-2024-3661)

    * Route to VPN server not stored in routing table that is specified by ipv4.route-table (JIRA:RHEL-73051)

    * VPN connections do not support ipv4.routing-rules settings (JIRA:RHEL-73052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-0288 advisory.

    [1:1.40.16-18.0.1]
    - disable MPTCP handling by default [Orabug: 35081472]
    - Fix ignore-carrier logic [Orabug: 34956744]
    - Disable regeneration of the documentation [Orabug: 34712048]
    - add connectivity check via Oracle servers [Orabug: 32051972]
    - Disable the build of NetworkManager-config-connectivity-* subpackage for 8.3
    - Revert 'infiniband: avoid normalizing the p-key when reading from ifcfg'

    [1:1.40.16-18]
    - vpn: fix routing rules support in vpn conenctions (RHEL-73052)
    - vpn: Place gateway route to table defined in ipvx.route-table (RHEL-73051)

    [1:1.40.16-17]
    - Rebuild to use the right tag

    [1:1.40.16-16]
    - Use /etc/hosts for hostname resolution (RHEL-53200)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:0288 advisory.

    Security and Bug Fix(es):

      * NetworkManager: DHCP routing options can manipulate interface-based VPN traffic (CVE-2024-3661)
      * Route to VPN server not stored in routing table that is specified by ipv4.route-table     (JIRA:AlmaLinux-73051)
      * VPN connections do not support ipv4.routing-rules settings (JIRA:AlmaLinux-73052)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-170 advisory.

  - DHCP can add routes to a client's routing table via the classless static route option (121). VPN-based     security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical     interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic     that was expected to be protected by the VPN. (CVE-2024-3661)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000139553 advisory.

    By design, the DHCP protocol does not authenticate messages, including for example the classless static     route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect     VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected     to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such     attacks.(CVE-2024-3661)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214375	AlmaLinux 9 : Security and bug fixes for NetworkManager (Medium) (ALSA-2025:0377)	Nessus	Alma Linux Local Security Checks	low
214288	Oracle Linux 9 : Security / and (ELSA-2025-0377)	Nessus	Oracle Linux Local Security Checks	low
214280	RHEL 9 : Securityes for NetworkManager (Moderate) (RHSA-2025:0377)	Nessus	Red Hat Local Security Checks	low
214070	RHEL 8 : Bug fix of NetworkManager (Moderate) (RHSA-2025:0288)	Nessus	Red Hat Local Security Checks	low
214051	Oracle Linux 8 : Bug (ELSA-2025-0288)	Nessus	Oracle Linux Local Security Checks	low
214010	AlmaLinux 8 : Bug fix of NetworkManager (Medium) (ALSA-2025:0288)	Nessus	Alma Linux Local Security Checks	low
200475	Fortinet FortiClient TunnelVision - CVE-2024-3661 (FG-IR-24-170)	Nessus	Windows	low
200474	Fortinet FortiClient TunnelVision - CVE-2024-3661 (FG-IR-24-170) (macOS)	Nessus	MacOS X Local Security Checks	low
197532	F5 Networks BIG-IP : VPN TunnelVision vulnerability (K000139553)	Nessus	F5 Networks Local Security Checks	high

Detections

Analytics

CVE-2024-3661

low

Tenable Plugins

low

low

low

low

low

low

low

low

high