CVE-2020-10136 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic

2020-06-0208:35:12

CWE-290

certcc

www.cve.org

AI Score

5.4

Confidence

High

EPSS

0.016

Percentile

87.6%

JSON

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

CNA Affected

[
  {
    "vendor": "IETF",
    "product": "RFC2003 - IP Encapsulation within IP",
    "versions": [
      {
        "version": "STD 1",
        "status": "affected"
      }
    ]
  }
]