TunnelVision - decloaking VPNs using DHCP
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection. ### Impact All users are potentially affected, as this attack vector can be used against _any_ VPN implementation without mitigations in place. ### Patches Currently, there are no existing mitigations employed by Quincy. ### Workarounds Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack. ### References https://www.leviathansecurity.com/blog/tunnelvision
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | quincy (crates.io) | up to 0.13.0 | — | No fix listed | GHSA-hqmp-g7ph-x543 |
- quincy (crates.io) Vendor— Affected up to 0.13.0 Fixed in — No fix listed GHSA-hqmp-g7ph-x543
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-03 Threatist record created from GHSA-hqmp-g7ph-x543
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences