TunnelVision vulnerability in HPE Aruba Networking Virtual Intranet Access clients

1) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU91755

Risk: Medium

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-3661

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to way the VPN client handles routes advertised by the DHCP server. A remote attacker with access to the local network can route the victim's traffic to a malicious server instead of sending it via a secured channel. 

This vulnerability was dubbed "TunnelVision".

Mitigation

Install update from vendor's website.

Vulnerable software versions

HPE Aruba Networking Virtual Intranet Access (VIA) Linux Client: before 4.7.2

HPE Aruba Networking Virtual Intranet Access (VIA) macOS Client: before 4.7.2

HPE Aruba Networking Virtual Intranet Access (VIA) iOS Client: before 4.7.2

HPE Aruba Networking Virtual Intranet Access (VIA) Windows Client: before 4.7.2

CPE2.3

• cpe:2.3:a:aruba_networks:hpe_aruba_networking_virtual_intranet_access_via_linux_client:*:*:*:*:*:*:*:*
• cpe:2.3:a:aruba_networks:hpe_aruba_networking_virtual_intranet_access_via_macos_client:*:*:*:*:*:*:*:*
• cpe:2.3:a:aruba_networks:hpe_aruba_networking_virtual_intranet_access_via_ios_client:*:*:*:*:*:*:*:*
• cpe:2.3:a:aruba_networks:hpe_aruba_networking_virtual_intranet_access_via_windows_client:*:*:*:*:*:*:*:*

External links

https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04841.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.