# Are Glinet mobile router protected against CVE-2024-3661 (tunnelvision)?

**URL:** <https://forum.gl-inet.com/t/are-glinet-mobile-router-protected-against-cve-2024-3661-tunnelvision/41994>\
**Category:** Router\
**Created:** [May 7, 2024, 3:52pm UTC](https://forum.gl-inet.com/t/are-glinet-mobile-router-protected-against-cve-2024-3661-tunnelvision/41994 "2024-05-07T15:52:32Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![mkdr](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@mkdr](https://forum.gl-inet.com/u/mkdr)\
**Post date:** [May 7, 2024, 3:52pm UTC](https://forum.gl-inet.com/t/are-glinet-mobile-router-protected-against-cve-2024-3661-tunnelvision/41994/1 "2024-05-07T15:52:32Z")

</div>

I read this article today (in German, need to translate to English via Chrome):

> **[Tunnelvision: Angreifer können VPNs aushebeln und Daten umleiten](https://www.heise.de/news/Tunnelvision-Angreifer-koennen-VPNs-aushebeln-und-Daten-umleiten-9710188.html)**
>
> Mit einer 22 Jahre alten DHCP-Option können Angreifer bewirken, dass Datenverkehr am VPN vorbeiläuft. Weder Nutzer noch VPN-Betreiber bekommen das mit.

There seems to be an issue with DHCP protocol, allowing to set routes via DHCP, which would compromise any VPN on the router, because it would bypass the VPN gw.

Here an English article about it:

> **[CVE-2024-3661: TunnelVision - How Attackers Can Decloak Routing-Based VPNs For...](https://www.leviathansecurity.com/blog/tunnelvision)**
>
> We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.

[![](https://img.youtube.com/vi/ajsLmZia6UU/maxresdefault.jpg "TunnelVision - CVE-2024-3661 - Decloaking Full and Split Tunnel VPNs - Leviathan Security Group") ](https://www.youtube.com/watch?v=ajsLmZia6UU)

I would ask Glinet support to look into the issue, and work out a fix for this issue. Glinet mobile routers are advertised to use in open WLAN like hotels, and have VPN protection. This issue would bypass the VPN if there is a compromised open WLAN with DHCP server.

---

_[View the full topic](https://forum.gl-inet.com/t/are-glinet-mobile-router-protected-against-cve-2024-3661-tunnelvision/41994)._