CVE-2024-3661, called TunnelVision, is a flaw in how VPN clients handle DHCP option 121 routes. An attacker on the same local network can push routes that send traffic outside the VPN tunnel. The record scores it 7.6 High while Fortinet scores its own products 5.0 Medium. Update clients and apply the vendor workarounds.
Weakness class: CWE-306, CWE-501.
What's affected
- Issue: DHCP classless static route option (121) can add routes to a client's routing table, so VPN solutions that rely on routes can be forced to leak traffic over the physical interface.
- Products in the record: Fortinet FortiClient and Cisco AnyConnect, among others.
- Fortinet advisory FG-IR-24-170 fixes: Windows 7.4.1 and 7.2.5; macOS 7.4.3 and 7.2.9; Linux 7.4.1 and 7.2.6. Versions 7.0 and 6.4 need migration to a fixed release.
- Severity conflict: the record says High, CVSS 7.6. Fortinet rates it Medium, CVSS 5.0 (temporal 4.7).
- Fortinet states it does not allow decryption of HTTPS traffic. The KEV flag is false.
How to check if you're exposed
- Identify which VPN clients your users run, and on which operating systems.
- For FortiClient, read the version in the About page and compare it with the fixed releases above.
- For other vendors, read their advisory for this CVE.
- Check whether your VPN profiles use full tunnel with exclusive routing, which Fortinet says is unaffected on Windows.
- For FortiGate devices acting as DHCP clients, check whether dhcp-classless-route-addition is enabled.
What to do now
- Update FortiClient on Windows, macOS and Linux to the fixed releases, or migrate off 7.0 and 6.4.
- On FortiClient Windows, use SSL-VPN full tunnel with exclusive routing, and avoid application based split tunneling which disables it.
- On FortiGate site to site setups, disable dhcp-classless-route-addition if it is not needed.
- For IPsec full tunnel, set enable_local_lan to 0 as the advisory describes.
- Tell staff to avoid unknown Wi-Fi networks, and use a trusted hotspot where they can.
Why it matters
The record lists CWE-306, missing authentication for a critical function, and CWE-501, trust boundary violation. DHCP has no authentication, and a client that accepts any server's routes trusts the local network too much. VPNs that rely on routing table entries to steer traffic inherit that trust.
The attacker must share the local network, so coffee shops, hotels and shared offices are the usual places. The Fortinet advisory notes the traffic is redirected before the VPN encrypts it, so this is about leaking traffic, not breaking the encryption.
The scoring difference is worth understanding. A general score assumes broad impact across products, while a vendor score reflects its own mitigations. Read both, then decide from your own configuration.
Quick check
Does this break HTTPS?
Fortinet says it does not allow decryption of HTTPS traffic. The traffic goes around the VPN instead.
Why 7.6 and 5.0?
The record carries 7.6 High. Fortinet rates its products 5.0 Medium. They measure different scopes.
Sources
Last reviewed: 19 October 2026.
