CVE-2026-9997 – VPN Split‑Tunneling Bypass via DHCP Option Injection

Program Code (Python simulated DHCP server + client)

#!/usr/bin/env python3
# rogue_dhcp_server.py - Injects a static route to bypass VPN split tunnel
import socket, struct, threading

def send_dhcp_offer(client_mac, offer_ip):
    # Craft a DHCP OFFER packet with Option 121 (Classless Static Route)
    # This option adds a route that sends traffic to a sensitive subnet via the attacker's gateway.
    # We'll simulate by creating a raw packet (simplified).
    # In a real attack, we'd use scapy; here we just demonstrate the concept.
    print(f"Sending DHCP OFFER to {client_mac} with malicious static route...")
    # The client would then apply this route and leak traffic.

CVE-2026-9997 – VPN Split‑Tunneling Bypass via DHCP Option Injection

Overview

A corporate VPN client accepts DHCP options (Option 121 – Classless Static Routes) from the local network without validation. An attacker on the same LAN can inject routes that send sensitive traffic outside the encrypted VPN tunnel.

Vulnerability Details

• Type: Network Configuration Injection
• Impact: Data exfiltration, bypass of VPN security policies.
• Root Cause: The VPN client blindly applies DHCP‑supplied static routes even after the tunnel is established.

Exploit Demonstration

1. Start the rogue DHCP server:
   root@kitploit:~

   python rogue_dhcp_server.py
   

2. On the victim machine (simulated), run the client simulation:
   root@kitploit:~

   python vpn_client_sim.py