Are Glinet mobile router protected against CVE-2024-3661 (tunnelvision)?

[SpitzAX3000]

@admon

From my point of view, this should not affect routers at all.

Not true! It affects all routers as long as DHCP Option 121 (which is the the default) supported! You can review the researchers blog: CVE-2024-3661: TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak — Leviathan Security Group - Penetration Testing, Security Assessment, Risk Advisory

@admon

Even if the DHCP is compromised, this wouldn’t stop the VPN encryption. So, the traffic might flow through other routes on WAN side - but since you never know about WAN side anyway, this won’t change security.

Again, not true! the VPN encryption would be de-cloaked by this attacking vector! If you use encrypted protocols such as HTTPS/SSH then you would be safe. Refer to Requirements for decloaking VPN traffic on the blog.

@admon

So I am not really aware what’s the deal with this CVE at all.

It's in fact an interesting vulnerability as it involves: rogue DHCP server plus using Option 121 to decloak VPN packets through a physical interface!

@admon

From my point of view, it’s only dangerous for devices running local VPN solutions with a 0.0.0.0/0 route. So not about routers.

Incorrect! It affects any *nix-based system connected to a VPN. The routes you referred to are part of the exploitation process!

@mkdr

The route bypasses any route set by the VPN tunnel.

Correct!

@admon

I am not convinced that OpenWrt would accept a route set by DHCP, but this needs to be tested.

It does! refer to the researcher's blog and test it against your GL device.

@admon

Conclusion

I would say that OpenWrt routers are not vulnerable in that case. Because sending the traffic to the new route is fine - even if it’s an evil device.

Your lab and testing are not correct! You need to understand the blog and watch the video first.