CVE-2023-36672
First published: Wed Aug 09 2023(Updated: )
An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. The VPN client insecurely configures the operating system such that traffic to the local network is sent in plaintext outside the VPN tunnel even if the local network is using a non-RFC1918 IP subnet. This allows an adversary to trick the victim into sending arbitrary IP traffic in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in leakage of traffic in plaintext" rather than to only Clario.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Clario VPN | <=5.9.1.1662 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-36672 vulnerability?
CVE-2023-36672 is a vulnerability found in the Clario VPN client for macOS (through version 5.9.1.1662) where the client insecurely configures the operating system, allowing traffic to the local network to be sent in plaintext outside the VPN tunnel.
How does CVE-2023-36672 impact users?
CVE-2023-36672 allows an adversary to intercept and view network traffic that is intended to be encrypted and secure, potentially exposing sensitive information.
What is the severity of CVE-2023-36672?
CVE-2023-36672 has a severity rating of medium, with a CVSS score of 5.7.
How can I fix CVE-2023-36672?
To fix CVE-2023-36672, users should update their Clario VPN client to a version that addresses the vulnerability and ensures that all network traffic is properly encrypted within the VPN tunnel.
Are there any references for CVE-2023-36672?
Yes, you can find more information about CVE-2023-36672 at the following references: [Reference 1](https://clario.co/vpn-for-mac/), [Reference 2](https://mullvad.net/de/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/), [Reference 3](https://tunnelcrack.mathyvanhoef.com/details.html)
- agent/references
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/author
- vendor/clario
- canonical/clario vpn
- version/clario vpn/5.9.1.1662