GHSA-hqmp-g7ph-x543
TunnelVision - decloaking VPNs using DHCP
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection.
Impact
All users are potentially affected, as this attack vector can be used against any VPN implementation without mitigations in place.
Patches
Currently, there are no existing mitigations employed by Quincy.
Workarounds
Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack.
References
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
TunnelVision - decloaking VPNs using DHCP
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection.
Impact
All users are potentially affected, as this attack vector can be used against any VPN implementation without mitigations in place.
Patches
Currently, there are no existing mitigations employed by Quincy.
Workarounds
Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack.
References
- Record
GHSA-hqmp-g7ph-x543- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
TunnelVision - decloaking VPNs using DHCP
A new decloaking technique for nearly all VPN implementations has been found, which allows attackers to inject entries into the routing tables of unsuspecting victims using DHCP option 121. This allows attackers to redirect traffic, which is supposed to be sent encrypted over the VPN, through the physical interface handling DHCP for the network the victim's computer is connected to, effectively bypassing the VPN connection.
Impact
All users are potentially affected, as this attack vector can be used against any VPN implementation without mitigations in place.
Patches
Currently, there are no existing mitigations employed by Quincy.
Workarounds
Disabling DHCP option 121 in the DHCP client is a potential workaround, as it prevents this kind of attack.
References
- Record
GHSA-hqmp-g7ph-x543- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
quincycrates.io | through 0.13.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-hqmp-g7ph-x543 is a medium vulnerability (CVSS 5.3) in quincy, published December 27, 2024. No source lists public exploit code. No source names a fixed version.