DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes.
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-0856
http://www.securityfocus.com/bid/578
http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ216141