CVE-2020-10136 (GCVE-0-2020-10136)

Vulnerability from cvelistv5 – Published: 2020-06-02 08:35 – Updated: 2025-11-03 20:33
VLAI
Title
IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
Summary
IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
Severity
No CVSS data available.
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Date Public
2020-06-01 00:00
Credits
Thanks to Yannay Livneh for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:33:32.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#636397",
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/636397/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.digi.com/resources/security"
          },
          {
            "name": "VU#636397",
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/636397"
          },
          {
            "name": "Security Concerns with IP Tunneling",
            "tags": [
              "x_transferred"
            ],
            "url": "https://datatracker.ietf.org/doc/html/rfc6169"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/199397"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RFC2003 - IP Encapsulation within IP",
          "vendor": "IETF",
          "versions": [
            {
              "status": "affected",
              "version": "STD 1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thanks to Yannay Livneh for reporting this issue."
        }
      ],
      "datePublic": "2020-06-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-17T21:10:04.191Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "VU#636397",
          "url": "https://kb.cert.org/vuls/id/636397/"
        },
        {
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4"
        },
        {
          "url": "https://www.digi.com/resources/security"
        },
        {
          "name": "VU#636397",
          "url": "https://www.kb.cert.org/vuls/id/636397"
        },
        {
          "name": "Security Concerns with IP Tunneling",
          "url": "https://datatracker.ietf.org/doc/html/rfc6169"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Customers should apply the latest patch provided by the affected vendor that addresses this issue and prevents unspecified IP-in-IP packets from being processed. Devices manufacturers are urged to disable IP-in-IP in their default configuration and require their customers to explicitly configure IP-in-IP as and when needed."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users can block IP-in-IP packets by filtering IP protocol number 4. Note this filtering is for the IPv4 Protocol (or IPv6 Next Header) field value of 4 and not IP protocol version 4 (IPv4)."
        }
      ],
      "x_generator": {
        "engine": "cveClient/1.0.15"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2020-10136",
    "datePublished": "2020-06-02T08:35:12.921Z",
    "dateReserved": "2020-03-05T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:33:32.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-10136",
      "date": "2026-10-03",
      "epss": "0.28537",
      "percentile": "0.98082"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.