I missed the TunnelVision vulnerability from last year: https://www.leviathansecurity.com/blog/tunnelvision

It just goes to show, when you look at the extra features and options in something (in this case, DHCP), you'd be amazed at what you find!