In addition, if a rogue DHCP is set to provide as default gateway an IP address of a machine controlled by a misbehaving user, it can sniff all the traffic sent by the clients to other networks, violating network security policies as well as user privacy (see man in the middle).
Moreover, if a rogue DHCP sets its default gateway to an IP address belonging to a machine managed by a problematic user, it could monitor all data sent by clients to other networks, thereby violating network security rules and infringing on user privacy (see man-in-the-middle attack).