VPN gaps in HPE Aruba Networking Virtual Intranet Access Client closed

VPN connections created with the HPE Aruba Networking Virtual Intranet Access (VIA) client under iOS, Linux, macOS, and Windows are not secure. The Android client is not affected. There is a security update for the other systems.

Tunnelvision vulnerability

In a warning message, the developers state that the VIA client up to and including version 4.7.0 is vulnerable. They state that they have closed two security gaps (CVE-2024-3661 “high”, CVE-2025-25041 “high”) in version 4.7.2.

The first vulnerability has been known since 2024 under the title “Tunnelvision”. At this point, remote attackers can start without authentication and start in the context of the network configuration service of the DHCP protocol to break VPN connections.

If attackers successfully exploit the second vulnerability, they can create DoS states. According to the HPE developers, there is still no evidence of attacks on either vulnerability.

(des)