New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation

TunnelVision (CVE-2024-3661) is a VPN-bypass technique where an attacker-operated DHCP server leverages DHCP option 121 to install routes that redirect VPN traffic outside the encrypted tunnel, enabling interception or modification of traffic; it affects major OSes supporting option 121 (Windows, Linux, macOS, iOS) and VPNs that rely on routing for security, has a CVSS of 7.6, and mitigations include DHCP snooping, ARP protections, port security, and network namespaces on Linux.