PatchTheCVECVE-2024-3661: DHCP can add routes to a client’s routing table via the classless static route option (121)
54
This month
HIGH 7.6UPGRADEUPGRADEUPGRADE
CVE-2024-3661 is a high-severity flaw (CVSS 7.6) affecting forticlient, forticlient, forticlient. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.
Why this priority
- High severity
- EPSS top 9%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Publisher (CNA): Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government · Vendor: cisco · fortinet · paloaltonetworks
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
fortinet forticlient UPGRADE
Affected: >= 6.4.0 and < 7.2.5 · 7.4.0
Fixed in: 7.2.5
Safe to downgrade to: a release before 6.4.0
1. Check installed version
apt-cache policy forticlient || rpm -q forticlient || forticlient --version
2. UPGRADE to 7.2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade forticlient
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade forticlient
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.4.0 (Debian / Ubuntu)
apt-cache madison forticlient
sudo apt install forticlient=<VERSION_BEFORE_6.4.0>
sudo apt-mark hold forticlient
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list forticlient
sudo dnf downgrade forticlient-<VERSION_BEFORE_6.4.0>
sudo dnf versionlock add forticlient
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
fortinet forticlient UPGRADE
Affected: >= 6.4.0 and < 7.2.5 · 7.4.0
Fixed in: 7.2.5
Safe to downgrade to: a release before 6.4.0
1. Check installed version
apt-cache policy forticlient || rpm -q forticlient || forticlient --version
2. UPGRADE to 7.2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade forticlient
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade forticlient
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.4.0 (Debian / Ubuntu)
apt-cache madison forticlient
sudo apt install forticlient=<VERSION_BEFORE_6.4.0>
sudo apt-mark hold forticlient
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list forticlient
sudo dnf downgrade forticlient-<VERSION_BEFORE_6.4.0>
sudo dnf versionlock add forticlient
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
fortinet forticlient UPGRADE
Affected: >= 6.4.0 and < 7.2.5 · 7.4.0
Fixed in: 7.2.5
Safe to downgrade to: a release before 6.4.0
1. Check installed version
apt-cache policy forticlient || rpm -q forticlient || forticlient --version
2. UPGRADE to 7.2.5 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade forticlient
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade forticlient
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.4.0 (Debian / Ubuntu)
apt-cache madison forticlient
sudo apt install forticlient=<VERSION_BEFORE_6.4.0>
sudo apt-mark hold forticlient
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list forticlient
sudo dnf downgrade forticlient-<VERSION_BEFORE_6.4.0>
sudo dnf versionlock add forticlient
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
cisco anyconnect vpn client MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy anyconnect-vpn-client || rpm -q anyconnect-vpn-client || anyconnect-vpn-client --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
cisco secure client MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy secure-client || rpm -q secure-client || secure-client --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
paloaltonetworks globalprotect MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy globalprotect || rpm -q globalprotect || globalprotect --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-3661?
forticlient: upgrade to 7.2.5; forticlient: upgrade to 7.2.5; forticlient: upgrade to 7.2.5. Exact commands for each OS are on this page.
Is CVE-2024-3661 being exploited?
CVE-2024-3661 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-3661 affect?
CVE-2024-3661 affects forticlient, forticlient, forticlient. Severity is high (CVSS 7.6). DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the
How urgent is CVE-2024-3661?
Priority 54/100. High severity; EPSS top 9%: very likely to be exploited; Public exploit reference
Software pages
Cisco vulnerabilities · Fortinet vulnerabilities
Related CVEs
- CVE-2026-44278 LOW 2.3 UPGRADE A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiC
- CVE-2026-70465 HIGH 8.1 UPGRADE A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClient
- CVE-2025-46373 HIGH 7.8 UPGRADE A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 throug
- CVE-2025-47761 HIGH 7.8 UPGRADE An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClien
- CVE-2025-54660 MEDIUM 5.5 UPGRADE An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.